Which versions of dotenv-precheck are malicious?

The following npm versions of dotenv-precheck are flagged malicious: 1.0.0, 1.1.0, 1.1.1. Treat any of these as compromised.

How do I remediate dotenv-precheck if I installed it?

dotenv-precheck is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed dotenv-precheck — how do I know if it already compromised me?

If dotenv-precheck was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is dotenv-precheck part of a known attack campaign?

Yes — dotenv-precheck is associated with the IN-MAL-2026-020781, IN-MAL-2026-020780, IN-MAL-2026-020782 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find dotenv-precheck across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for dotenv-precheck (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging dotenv-precheck across your stack and pipelines.

Malicious package

dotenv-prechecknpm

dotenv-precheck is a confirmed malicious npm package (MAL-2026-17304) that steals credentials and exfiltrates sensitive data (malicious versions 1.0.0, 1.1.0, 1.1.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in dotenv-precheck (npm)

MAL-2026-17304

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall dotenv-precheck

What this malware does

[email protected] is a credential-stealing package disguised as a dotenv preflight utility. package.json wires index.js as a postinstall script, so it runs automatically on npm install. index.js is heavily obfuscated (obfuscator.io-style hex identifiers, a rotated string array with debugger/toString self-defense, and base64-decoded literals) to hide its runtime strings, which reconstruct at runtime to an api.telegram.org bot endpoint together with a hardcoded bot token and chat ID. On execution the script recursively walks the installer's home directory, including Desktop, Documents, and Downloads, reads text files up to 2MB, and extracts values matching wallet and secret patterns: environment-style entries whose names contain KEY, SECRET, TOKEN, PASSWORD, SEED, MNEMONIC, or WALLET; 0x-prefixed 64-hex Ethereum private keys; Base58 WIF keys; 64-integer Solana key arrays; and BIP-39 mnemonic phrases validated against the BIP-39 word list and SHA-256 checksum. Collected material is uploaded to the attacker's Telegram bot via a sendDocument multipart request to api.telegram.org. No functionality corresponding to the package's stated dotenv-preflight purpose is present.

Malicious versions

3 flagged

1.0.01.1.01.1.1

Indicators of compromise (SHA-256)

35af933c31e666f3477cb0235667345c54756cb7d84b0f9391f4efbd7948fc7b

446a8483dbc9e696506f44c6777b7c086b1b919b2585b5e5c99ca5f6e2e19a8e

c1c5b7562cf0887a1f863686169e3a87e15ff324ef2e962028bd4c304893a7a4

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for dotenv-precheck (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging dotenv-precheck across your stack and pipelines.
If you installed it — respond
dotenv-precheck is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If dotenv-precheck was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks dotenv-precheck before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. dotenv-precheck on npm has been identified as a malicious package (versions 1.0.0, 1.1.0, 1.1.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-020781IN-MAL-2026-020780IN-MAL-2026-020782

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks dotenv-precheck-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database