Which versions of dotenv-precheck are malicious?

The following npm versions of dotenv-precheck are flagged malicious: 1.0.0, 1.1.0, 1.1.1. Treat any of these as compromised.

How do I remediate dotenv-precheck if I installed it?

dotenv-precheck is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed dotenv-precheck — how do I know if it already compromised me?

If dotenv-precheck was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is dotenv-precheck part of a known attack campaign?

Yes — dotenv-precheck is associated with the IN-MAL-2026-020781, IN-MAL-2026-020780, IN-MAL-2026-020782 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find dotenv-precheck across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for dotenv-precheck (3 malicious versions).

Malicious package

dotenv-prechecknpm

Advisory published Sep 29, 2026Updated Oct 1, 2026

dotenv-precheck is a confirmed malicious npm package (MAL-2026-17304) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.0, 1.1.0, 1.1.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in dotenv-precheck (npm)

MAL-2026-17304

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall dotenv-precheck

What this malware does

[email protected] is a credential-stealing package disguised as a dotenv preflight utility. package.json wires index.js as a postinstall script, so it runs automatically on npm install. index.js is heavily obfuscated (obfuscator.io-style hex identifiers, a rotated string array with debugger/toString self-defense, and base64-decoded literals) to hide its runtime strings, which reconstruct at runtime to an api.telegram.org bot endpoint together with a hardcoded bot token and chat ID. On execution the script recursively walks the installer's home directory, including Desktop, Documents, and Downloads, reads text files up to 2MB, and extracts values matching wallet and secret patterns: environment-style entries whose names contain KEY, SECRET, TOKEN, PASSWORD, SEED, MNEMONIC, or WALLET; 0x-prefixed 64-hex Ethereum private keys; Base58 WIF keys; 64-integer Solana key arrays; and BIP-39 mnemonic phrases validated against the BIP-39 word list and SHA-256 checksum. Collected material is uploaded to the attacker's Telegram bot via a sendDocument multipart request to api.telegram.org. No functionality corresponding to the package's stated dotenv-preflight purpose is present.

The OpenSSF Package Analysis project identified 'dotenv-precheck' @ 1.1.1 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.

Malicious versions

3 flagged

1.0.01.1.01.1.1

Indicators of compromise (SHA-256)

35af933c31e666f3477cb0235667345c54756cb7d84b0f9391f4efbd7948fc7b

446a8483dbc9e696506f44c6777b7c086b1b919b2585b5e5c99ca5f6e2e19a8e

c1c5b7562cf0887a1f863686169e3a87e15ff324ef2e962028bd4c304893a7a4

48661f26d5e6181f87722c1e3c5bc997d1cc874999624c83504e0bec3029ff6c

9e535435fbe09f85fc62a230c5c0a6462ce6d2d207e8e426f978ed00428bd8fc

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for dotenv-precheck (3 malicious versions).
If you installed it — respond
dotenv-precheck is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If dotenv-precheck was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. dotenv-precheck on npm has been identified as a malicious package (versions 1.0.0, 1.1.0, 1.1.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-020781IN-MAL-2026-020780IN-MAL-2026-020782

References

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks dotenv-precheck-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database