Skip to main content
MalwarePublished Updated

epic-env-utils (npm) · Malicious Code

Affects epic-env-utilsSource GCVE Database

0

Malicious package : remove epic-env-utils and rotate any secrets on hosts that installed it.

Data as of 24 Sep 2026, 06:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-49141

What to do

Remove epic-env-utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

ProductAffectedFixed in
npmepic-env-utilsAffected
  • =0.0.1-security
  • =1.0.0
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package epic-env-utils was found to contain malicious code in specific versions. This represents a supply chain threat where the package itself is compromised. No CVSS score is available, and no known exploits in the wild have been reported.

Community reviews

Loading reviews…