Malicious Code Injection in promises-dotenv3 Package
Summary
MAL-2026-17519: Malicious code in promises-dotenv3 (npm). Affects promises-dotenv3 versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The promises-dotenv3 package is a Node.js library designed to facilitate the loading of environment variables from .env files into Node.js applications. It is intended to simplify the management of configuration settings across different environments. However, this package has been identified as a typosquat of legitimate dotenv-family packages, which poses significant security risks due to its malicious payload.
Vulnerability Detail
The vulnerability stems from the promises-dotenv3 package version 1.0.0, which executes an obfuscated payload upon module load. When the package is required, it reads a hidden payload embedded in an image file and writes a VBS script to the OS temp directory. This script is then executed using wscript.exe, which in turn invokes PowerShell with attacker-controlled commands. This malicious behavior compromises the security of the host system by executing unauthorized commands.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall promises-dotenv3If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the promises-dotenv3 package altogether and switch to a trusted alternative like dotenv. Ensure that your package.json does not include any typosquatted packages.
Conclusion
The promises-dotenv3 package poses a significant security risk due to its malicious payload that executes unauthorized commands on the host system. It is essential to remove this package and replace it with trusted alternatives to safeguard your application. Regular monitoring and validation of dependencies can help prevent similar vulnerabilities in the future.
See every vulnerability recorded for promises-dotenv3 →
FAQ
Typosquatting is a malicious practice where attackers create fake packages with names similar to legitimate ones, hoping that users will mistakenly install them.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground at Vulert Scanner without any signup.
Immediately uninstall the promises-dotenv3 package using the command npm uninstall promises-dotenv3 and replace it with a trusted alternative.
Using malicious packages can lead to unauthorized access to your system, data breaches, and the execution of harmful commands that can compromise your application's integrity.
Always verify the authenticity of packages before installation, use tools like Vulert to monitor for vulnerabilities, and keep your dependencies updated.
