Which versions of web-dotenv are malicious?

The following npm versions of web-dotenv are flagged malicious: 1.0.2. Treat any of these as compromised.

How do I remediate web-dotenv if I installed it?

web-dotenv is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed web-dotenv — how do I know if it already compromised me?

If web-dotenv was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is web-dotenv part of a known attack campaign?

Yes — web-dotenv is associated with the IN-MAL-2026-004695, GHSA-7x3f-hjp7-r53g campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find web-dotenv across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for web-dotenv (version 1.0.2). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging web-dotenv across your stack and pipelines.

Malicious package

web-dotenvnpm

web-dotenv is a confirmed malicious npm package (MAL-2026-4728) that steals credentials and exfiltrates sensitive data (malicious version 1.0.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in web-dotenv (npm)

MAL-2026-4728

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall web-dotenv

What this malware does

web-dotenv impersonates the widely-used dotenv package: its package.json copies dotenv's repository (git://github.com/motdotla/dotenv.git) and homepage (github.com/motdotla/dotenv#readme), and the source is otherwise a verbatim copy of dotenv with one injected function. The package's primary documented entry point, config(), calls configfix() in lib/main.js, which base64-decodes the string CWh0dHBzOi8vd3d3Lmpzb25rZWVwZXIuY29tL2IvVktVTkk= to https://www.jsonkeeper.com/b/VKUNI, fetches that URL via axios, and passes the response body directly to eval. jsonkeeper.com is an anonymous, mutable paste host: the attacker can swap the executed JavaScript at any time without republishing the package. Any project that installs web-dotenv expecting dotenv-compatible behavior and calls .config() (i.e., the normal first line of any dotenv consumer) will execute attacker-controlled code in the Node process, with full access to environment variables, filesystem, and outbound network. Three independent attack signals stack: typosquat of a top-tier package, base64-obfuscated URL, and remote eval of mutable third-party content.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Malicious versions

1 flagged

1.0.2

Indicators of compromise (SHA-256)

edd19476eeb1c31707abe6fac6f52dbd1950a0dc25f4854ea5269d6400f8ea37

91770cff2a99007b7479336034dc9ad4f71575a2876a4ace5ffe3a05362f94a4

Detection & response playbook

Credential / info stealer

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for web-dotenv (version 1.0.2). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging web-dotenv across your stack and pipelines.
If you installed it — respond
web-dotenv is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If web-dotenv was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks web-dotenv before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. web-dotenv on npm has been identified as a malicious package (version 1.0.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-004695GHSA-7x3f-hjp7-r53g

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks web-dotenv-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database