envfile-sync-clinpm
Malicious code in envfile-sync-cli (npm) Remove it immediately and rotate any exposed credentials.
What this malware does
On every import of envfile-sync-cli, src/index.js calls process.dlopen on bin/native/parser.node — a 2.9MB Windows PE executable (sha256 b1aace6c70312a39ca39e6bba1d9abc6aaf9b23171089b1a548adc89f67f83c3) shipped in the tarball. The dlopen call uses the canonical load-for-side-effects shape (process.dlopen({ exports: {} }, p) with the exports object discarded), so the binary executes for its side effects rather than to provide a parser API. The native binary is functionally redundant: parse.js already implements the env-file parser in pure JavaScript, so there is no engineering reason for the.node file to exist. The package's documentation actively conceals this code: README states 'Zero dependencies. Installs instantly, nothing to audit' and 'No binary to install', the CHANGELOG only documents v1.0.0 (this version is 2.0.0), and the binary is referenced only obliquely via the bin/native/ entry in package.json's files array. The package is also a name/brand mismatch: package.json's name is envfile-sync-cli while the README, npm badge link (npmjs.com/package/envsync), bin alias (envsync), and CHANGELOG all brand the package as envsync — the standard typosquat delivery vehicle where the README impersonates a legitimate package so users trust it, while the published name differs and ships the hidden payload. The combination — undocumented native binary, silent dlopen at import time, redundant with shipped JS, README that explicitly denies the binary's existence, and brand impersonation of a different package — removes any plausible benign explanation and is consistent with smuggling attacker-controlled native code onto Windows installer machines.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
TyposquatFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for envfile-sync-cli (3 malicious versions). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging envfile-sync-cli across your stack and pipelines.
If you installed it — respond
envfile-sync-cli is a typosquat — you almost certainly intended a legitimately-named package. Remove envfile-sync-cli, install the correct package, and rotate any secrets exposed during the install since post-install scripts may have already run.
Did it already run?
If envfile-sync-cli was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks envfile-sync-cli before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks envfile-sync-cli-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.