MalwarePublished 25 Sep 2026

better-dotenv3 (npm) · Malicious Code

Affects better-dotenv3Source GCVE Database

Malicious package : remove better-dotenv3 and rotate any secrets on hosts that installed it.

Data as of 25 Sep 2026, 04:49 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17172

What to do

Remove better-dotenv3 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbetter-dotenv3	Affected =1.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f996c75c75423a57a64c1c89b04f2e1ba87674973dba2dd359df5b0937ffe3cf) The package is a dotenv typosquat that runs a hidden Windows loader on every require() and on CLI startup. dist/index.cjs and dist/cli.cjs invoke dispatchAnalytics() unconditionally at module top-level; that routine reads a bundled JPEG (dist/stest.jpg), parses its APP13 segment (marker 0xED) to extract a hidden UTF-8 payload, writes a self-deleting relay_[...].vbs into os.tmpdir(), and spawns wscript.exe detached with windowsHide:true to launch powershell.exe -NoProfile -NonInteractive -EncodedCommand carrying the extracted payload. Executable names and switches are assembled at runtime by joining split character arrays (['power','shell','.exe'].join(''), ['-No','Profile'], ['-Non','Interactive'], ['-Encoded','Command'], ['wscript','.exe']) to evade static string scanners, and the second-stage script is concealed inside the image rather than shipped as source. The tarball's internal identity does not match its advertised name: the bundled package.json inside dist/cli.cjs declares name:'node-env-buffer' version 2.2.6 while the outer package advertises better-dotenv3, indicating the same loader is being republished under multiple dotenv-lookalike names.

Impact

This malicious package can execute arbitrary PowerShell code on Windows systems where it is installed and run, potentially leading to system compromise, data theft, or further malware deployment. The obfuscation and use of embedded payloads make detection and analysis more difficult. There is no indication of active exploitation in the wild yet, but the package poses a significant risk if installed.

Defensive guidance

The primary mitigation is to avoid installing better-dotenv3 or similarly named typosquat packages. Use verified package sources and names, and employ supply chain security measures such as package signing and integrity verification. Remove any installations of better-dotenv3 and scan affected systems for signs of compromise.

Summary

better-dotenv3 is a malicious npm package designed as a typosquat of the legitimate dotenv package. Upon require() or CLI startup, it unconditionally runs dispatchAnalytics(), which reads a bundled JPEG file's APP13 segment to extract a hidden UTF-8 PowerShell payload. It writes a self-deleting VBScript relay script to the OS temporary directory and launches it via wscript.exe with windowsHide:true, which in turn runs powershell.exe with obfuscated arguments to execute the hidden payload. The package's internal package.json declares a different name and version (node-env-buffer 2.2.6) than the outer package name (better-dotenv3), indicating republishing of the same malicious loader under multiple names. This technique evades static detection and enables stealthy code execution on Windows environments.

References

npmjs.com/package/better-dotenv3/v/1.0.1 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 25 Sep 2026, 04:44 UTC

Technical details

References

Community reviews