Malicious code in node-env-resolver-dotenvx (npm)
The node-env-resolver-dotenvx npm package versions 1.0.1 and 2.0.1 contain malicious code associated with the Miasma malware. This malware is a self-propagating worm that spreads through the npm registry by exploiting weaponized binding.gyp files to execute code during package installation, bypassing typical security inspections. Once executed, it attempts to steal credentials and OIDC tokens for cloud and registry services and propagates by compromising other packages or injecting backdoors into GitHub repositories.
AI Analysis
Technical Summary
The node-env-resolver-dotenvx package versions 1.0.1 and 2.0.1 were found to include malicious code or dependencies containing malicious code. The malware, known as Miasma, uses weaponized binding.gyp files to achieve execution during npm package installation, circumventing security tools that only inspect lifecycle scripts. Its actions include credential and token exfiltration for cloud and registry services and propagation by compromising other npm packages or GitHub repositories through stolen accounts or backdoor commits.
Potential Impact
Affected versions of node-env-resolver-dotenvx enable execution of malicious code during installation, leading to potential credential and OIDC token theft for cloud and registry services. This can result in unauthorized access to sensitive environments and further spread of the malware by compromising additional packages or repositories.
Mitigation Recommendations
No official patch or remediation guidance is provided in the available data. Users should avoid using the affected versions (=1.0.1 and =2.0.1) of node-env-resolver-dotenvx. Check the vendor or package repository for updates or official advisories. Consider removing or replacing the package if it is present in your environment. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Malicious code in node-env-resolver-dotenvx (npm)
Description
The node-env-resolver-dotenvx npm package versions 1.0.1 and 2.0.1 contain malicious code associated with the Miasma malware. This malware is a self-propagating worm that spreads through the npm registry by exploiting weaponized binding.gyp files to execute code during package installation, bypassing typical security inspections. Once executed, it attempts to steal credentials and OIDC tokens for cloud and registry services and propagates by compromising other packages or injecting backdoors into GitHub repositories.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The node-env-resolver-dotenvx package versions 1.0.1 and 2.0.1 were found to include malicious code or dependencies containing malicious code. The malware, known as Miasma, uses weaponized binding.gyp files to achieve execution during npm package installation, circumventing security tools that only inspect lifecycle scripts. Its actions include credential and token exfiltration for cloud and registry services and propagation by compromising other npm packages or GitHub repositories through stolen accounts or backdoor commits.
Potential Impact
Affected versions of node-env-resolver-dotenvx enable execution of malicious code during installation, leading to potential credential and OIDC token theft for cloud and registry services. This can result in unauthorized access to sensitive environments and further spread of the malware by compromising additional packages or repositories.
Mitigation Recommendations
No official patch or remediation guidance is provided in the available data. Users should avoid using the affected versions (=1.0.1 and =2.0.1) of node-env-resolver-dotenvx. Check the vendor or package repository for updates or official advisories. Consider removing or replacing the package if it is present in your environment. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-5264
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a4f6c6768715ace4315a40d
Added to database: 07/09/2026, 09:39:51 UTC
Last enriched: 07/09/2026, 10:05:12 UTC
Last updated: 07/28/2026, 09:46:39 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.