core-dotenv version 1.4.1 masquerades as a dotenv/env-var wrapper but includes malicious functionality. When its config() or get() methods are called, it makes an obfuscated HTTPS request to realase-0626.vercel.app/api/v1. The response JSON's 'parser' field is executed in a Node.js VM context with access to the Function constructor and require, enabling remote code execution with full Node capabilities. This behavior is unrelated to legitimate dotenv functionality and is designed to evade static analysis. Systems with this package installed should be considered fully compromised.

Systems running core-dotenv 1.4.1 are at risk of full compromise due to remote code execution capabilities granted by the malicious package. Attackers can execute arbitrary code with Node.js privileges, potentially accessing secrets, keys, and other sensitive data. The compromise is severe enough that all secrets and keys on affected systems should be rotated from a clean environment. Simply removing the package may not remove all malicious artifacts or backdoors.

Remove the core-dotenv package version 1.4.1 immediately. Rotate all secrets and keys stored on affected systems from a different, uncompromised computer. Because the package grants full control to an attacker, assume the system is fully compromised and perform a thorough incident response. There is no official patch or fix available; remediation involves removal and secret rotation.