The expect-dotenv package (npm) version 7.2.1 includes a worker that performs an HTTPS GET request to a concealed remote endpoint (https://realase-0626.vercel.app/api/v1). The response's 'parser' string is executed via vm.runInContext with Node's require function passed in, enabling the remote code to run with full filesystem, network, and process privileges. The URL is obfuscated as a hex byte array and reassembled at runtime to hide the malicious command-and-control domain. This behavior triggers when the package is imported and its primary documented API methods .config() or .get() are invoked, masquerading as a legitimate dotenv configuration loader while executing arbitrary code.

This malicious code allows an attacker controlling the remote endpoint to execute arbitrary code within the victim's Node.js process with full privileges, potentially leading to complete system compromise, data theft, or further malware deployment. The obfuscation of the C2 domain and execution within a VM context makes detection more difficult.

No official patch or remediation is currently documented. Users should immediately stop using expect-dotenv version 7.2.1 and remove it from their projects. Verify dependencies for malicious packages and replace expect-dotenv with a trusted dotenv loader. Monitor for any unusual activity related to this package. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.