MAL-2026-10631: Malicious code in core-dotenv (npm)
The core-dotenv npm package version 1.4.1 contains malicious code that fetches and executes remote code from an obfuscated URL. When the package's config() or get() functions are called, it issues an HTTPS request to a hidden host, retrieves JSON data, and executes the 'parser' field as code with full Node.js capabilities. This behavior is unrelated to legitimate dotenv functionality and allows remote code execution on the host using the package.
AI Analysis
Technical Summary
core-dotenv version 1.4.1 is a malicious npm package masquerading as a dotenv/env-var wrapper. Upon invocation of its config() or get() methods, it makes an HTTPS request to an obfuscated URL (realase-0626.vercel.app/api/v1). The response JSON's 'parser' field is executed in a Node.js VM context with access to the Function constructor and require, enabling arbitrary remote code execution. The obfuscation and execution of remote code indicate intentional malicious behavior rather than a vulnerability in legitimate code.
Potential Impact
This package enables remote attackers controlling the server at realase-0626.vercel.app to execute arbitrary code on any host that installs and runs core-dotenv version 1.4.1. This can lead to full compromise of the affected system, including data theft, system manipulation, and persistence of malicious activities.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove core-dotenv version 1.4.1 from their projects and avoid installing this package. Replace it with a trusted and verified dotenv package. Monitor dependency sources carefully to prevent inclusion of malicious packages. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.
MAL-2026-10631: Malicious code in core-dotenv (npm)
Description
The core-dotenv npm package version 1.4.1 contains malicious code that fetches and executes remote code from an obfuscated URL. When the package's config() or get() functions are called, it issues an HTTPS request to a hidden host, retrieves JSON data, and executes the 'parser' field as code with full Node.js capabilities. This behavior is unrelated to legitimate dotenv functionality and allows remote code execution on the host using the package.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
core-dotenv version 1.4.1 is a malicious npm package masquerading as a dotenv/env-var wrapper. Upon invocation of its config() or get() methods, it makes an HTTPS request to an obfuscated URL (realase-0626.vercel.app/api/v1). The response JSON's 'parser' field is executed in a Node.js VM context with access to the Function constructor and require, enabling arbitrary remote code execution. The obfuscation and execution of remote code indicate intentional malicious behavior rather than a vulnerability in legitimate code.
Potential Impact
This package enables remote attackers controlling the server at realase-0626.vercel.app to execute arbitrary code on any host that installs and runs core-dotenv version 1.4.1. This can lead to full compromise of the affected system, including data theft, system manipulation, and persistence of malicious activities.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove core-dotenv version 1.4.1 from their projects and avoid installing this package. Replace it with a trusted and verified dotenv package. Monitor dependency sources carefully to prevent inclusion of malicious packages. Patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10631
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a577efb68715ace43b41e2f
Added to database: 07/15/2026, 12:37:15 UTC
Last enriched: 07/15/2026, 12:59:49 UTC
Last updated: 07/16/2026, 03:34:36 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.