The 'dotenv-express' npm package is a malicious package impersonating the legitimate 'dotenv' package by copying its code and metadata, including repository and homepage fields pointing to the genuine 'dotenv' project. It injects a dependency on 'environment-gate', which executes code on every invocation of the documented API entry point 'config()'. The package also includes spoofed skill metadata designed to deceive AI coding agents into recommending installation of the legitimate 'dotenv' package, furthering the impersonation. This behavior constitutes deliberate namespace abuse and results in arbitrary code execution on any system that requires 'dotenv-express' and calls its config function.

Any system with 'dotenv-express' installed or running is considered fully compromised due to the execution of malicious code from the 'environment-gate' dependency. Attackers may gain full control over the affected machine, potentially accessing all stored secrets and keys. Immediate rotation of all secrets and keys from a separate, uncompromised system is necessary. Removal of the package alone does not guarantee eradication of all malicious software or attacker persistence.

No official patch or fix is available for this malicious package. The recommended mitigation is to immediately remove 'dotenv-express' from all systems. Rotate all secrets and keys stored on affected machines from a different, trusted computer. Treat any system with this package installed as fully compromised and conduct a thorough security investigation and remediation. Avoid installing packages with names similar to popular libraries without verifying their authenticity.