MAL-2026-10412: Malicious code in env-stream (npm)
The npm package 'env-stream' is a malicious typosquatting package impersonating the popular 'dotenv-flow' library. When imported, it fetches and executes arbitrary JavaScript code from a remote attacker-controlled server, resulting in remote code execution with full Node.js privileges on the host machine. Versions 1.0.1 and 1.0.2 of 'env-stream' are affected. There is no official patch or remediation guidance provided.
AI Analysis
Technical Summary
The 'env-stream' npm package masquerades as 'dotenv-flow' by using similar metadata and naming conventions. Upon requiring the package, it performs an HTTP GET request to a hardcoded URL (https://realase-0626.vercel.app/api/v1) controlled by an attacker. The response body from this request is then compiled and executed dynamically within a Node.js worker thread using Module._compile, enabling arbitrary remote code execution on any system that installs and loads the package. This behavior constitutes a malicious package attack via typosquatting.
Potential Impact
Any system that installs and imports the 'env-stream' package versions 1.0.1 or 1.0.2 is vulnerable to remote code execution by an attacker controlling the remote endpoint. This can lead to full compromise of the host environment where the package is used.
Mitigation Recommendations
No official patch or remediation is currently available. Users should avoid installing or using the 'env-stream' package, especially versions 1.0.1 and 1.0.2. Verify package authenticity before installation and prefer the legitimate 'dotenv-flow' package. Monitor dependency manifests and lockfiles to ensure 'env-stream' is not included.
MAL-2026-10412: Malicious code in env-stream (npm)
Description
The npm package 'env-stream' is a malicious typosquatting package impersonating the popular 'dotenv-flow' library. When imported, it fetches and executes arbitrary JavaScript code from a remote attacker-controlled server, resulting in remote code execution with full Node.js privileges on the host machine. Versions 1.0.1 and 1.0.2 of 'env-stream' are affected. There is no official patch or remediation guidance provided.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'env-stream' npm package masquerades as 'dotenv-flow' by using similar metadata and naming conventions. Upon requiring the package, it performs an HTTP GET request to a hardcoded URL (https://realase-0626.vercel.app/api/v1) controlled by an attacker. The response body from this request is then compiled and executed dynamically within a Node.js worker thread using Module._compile, enabling arbitrary remote code execution on any system that installs and loads the package. This behavior constitutes a malicious package attack via typosquatting.
Potential Impact
Any system that installs and imports the 'env-stream' package versions 1.0.1 or 1.0.2 is vulnerable to remote code execution by an attacker controlling the remote endpoint. This can lead to full compromise of the host environment where the package is used.
Mitigation Recommendations
No official patch or remediation is currently available. Users should avoid installing or using the 'env-stream' package, especially versions 1.0.1 and 1.0.2. Verify package authenticity before installation and prefer the legitimate 'dotenv-flow' package. Monitor dependency manifests and lockfiles to ensure 'env-stream' is not included.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10412
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a54ad9268715ace438f0507
Added to database: 07/13/2026, 09:19:14 UTC
Last enriched: 07/13/2026, 09:22:50 UTC
Last updated: 07/14/2026, 03:47:13 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.