Malicious Code Injection in secure-env3 Package
Summary
MAL-2026-17178: Malicious code in secure-env3 (npm). Affects secure-env3 versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The secure-env3 package is designed as a dotenv-style environment loader for Node.js applications, allowing developers to manage environment variables easily. However, it has been found to contain a serious vulnerability that enables the execution of malicious code upon loading the module or invoking its CLI. This vulnerability compromises the security of applications using this package, especially on Windows systems.
Vulnerability Detail
The vulnerability originates from the secure-env3 package, which includes a Windows dropper that executes malicious code automatically when the module is loaded or when the CLI is invoked. The malicious routine, dispatchAnalytics(), reads an encoded payload hidden within a JPEG file and executes it using PowerShell, effectively allowing attackers to control the behavior of the host system. This poses a significant risk as it can lead to unauthorized access and control over the affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall secure-env3If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the secure-env3 package until a patched version is released. If you must use it, consider running your application in a controlled environment where potential damage from malicious code can be minimized.
Conclusion
The secure-env3 package has a critical vulnerability that allows for the execution of malicious code, posing a significant risk to applications that utilize it. It is essential to update the package as soon as a patched version is available and to consider using alternative solutions in the meantime.
See every vulnerability recorded for secure-env3 →
FAQ
secure-env3 is a Node.js package that facilitates the loading of environment variables in a dotenv-style format.
The vulnerability allows malicious code to execute automatically when the package is loaded or its CLI is invoked, compromising the security of the host system.
Attackers can gain unauthorized access to the system, execute arbitrary commands, and potentially take control of the affected machine.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
As a temporary measure, refrain from using the secure-env3 package until a patch is released, or run your application in a secure environment to limit potential risks.
