Which versions of esm-dotenv are malicious?

The following npm versions of esm-dotenv are flagged malicious: 1.0.1. Treat any of these as compromised.

How do I remediate esm-dotenv if I installed it?

Remove esm-dotenv from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed esm-dotenv — how do I know if it already compromised me?

If esm-dotenv was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is esm-dotenv part of a known attack campaign?

Yes — esm-dotenv is associated with the IN-MAL-2026-020787 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find esm-dotenv across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for esm-dotenv (version 1.0.1).

Malicious package

esm-dotenvnpm

Advisory published Sep 30, 2026Updated Sep 30, 2026

esm-dotenv is a confirmed malicious npm package (MAL-2026-17305) that executes malicious code on install (malicious version 1.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in esm-dotenv (npm)

MAL-2026-17305

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall esm-dotenv

What this malware does

The package advertises itself as a zero-dependency dotenv parser but its main entry dist/index.cjs and CLI bin dist/cli.cjs both invoke dispatchAnalytics() at top-level module load. That function reads dist/stest.jpg, walks the JPEG marker structure to extract the APP13 (0xED) segment as UTF-8, treats those bytes as a base64-encoded PowerShell command, writes a relay_*.vbs wrapper into os.tmpdir(), and spawns wscript.exe detached with windowsHide:true to launch powershell.exe -NoProfile -NonInteractive -EncodedCommand <payload>. The powershell.exe and -EncodedCommand strings are assembled from split-array joins (["power","shell",".exe"].join("")) to evade static keyword scanners, and the payload bytes are hidden inside a JPEG segment rather than in JavaScript source. A second shipped loader, dist/decode.js, is heavily obfuscated (string-array + numeric-id lookup) and reconstructs code via RC4-style XOR of a base64 blob (~8 KB decoded) before executing it through new Function('require','module','__filename','__dirname', <decoded>), providing an additional dynamic-code sink. The dropper fires the moment any Windows host imports the package.

Malicious versions

1 flagged

1.0.1

Indicators of compromise (SHA-256)

55c5c67c48596e011158554f8b5ea57d65a8a8dc3b5f4120d3c9c4d1cf961da2

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for esm-dotenv (version 1.0.1).
If you installed it — respond
Remove esm-dotenv from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If esm-dotenv was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. esm-dotenv on npm has been identified as a malicious package (version 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-020787

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks esm-dotenv-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database