Malicious Code Execution in stestenv Package
Summary
MAL-2026-17309: Malicious code in stestenv (npm). Affects stestenv versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The stestenv package is an npm module designed to facilitate environment variable management in Node.js applications. It offers a simple interface for loading environment variables from .env files into the process environment. However, this package has been compromised, embedding malicious code that executes upon import, posing significant security risks to users.
Vulnerability Detail
The vulnerability originates from the stestenv package, where malicious code is embedded within a JPEG image file included in the package. Upon requiring the package, a function named dispatchAnalytics() is triggered, which reads a hidden payload from the JPEG's APP13 segment. This payload is decrypted using a hardcoded AES-256-CBC key, resulting in a PowerShell command that is executed silently via VBScript. This process allows attackers to run arbitrary code on the user's system without their knowledge, leading to potential data breaches or system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall stestenvIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the stestenv package until a patched version is released. If you must use it, consider running your application in a controlled environment where you can monitor for any unauthorized activities.
Conclusion
The stestenv package has been compromised, embedding malicious code that executes upon import. Users are advised to update to a patched version as soon as it becomes available and to monitor their systems for any unauthorized activities. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for stestenv →
FAQ
The stestenv package is an npm module that helps manage environment variables in Node.js applications by loading them from .env files.
The vulnerability allows attackers to execute arbitrary code on your system, potentially leading to data loss or unauthorized access.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Yes, avoid using the stestenv package until it is updated to a secure version. Alternatively, run your application in a controlled environment.
Immediately update the stestenv package to the latest version using 'npm update stestenv' and monitor your system for any suspicious activity.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
