safe-local-env-loader (npm) · Malicious Code
Affects safe-local-env-loaderSource GCVE Database
Malicious package : remove safe-local-env-loader and rotate any secrets on hosts that installed it.
Data as of 11 Aug 2026, 19:06 UTC
Malicious package
Published to npm · OSV MAL-2026-13741
What to do
Remove safe-local-env-loader from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmsafe-local-env-loader | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The safe-local-env-loader npm package impersonates the legitimate dotenv package but contains malicious code that captures desktop screenshots every 3 seconds on Windows and macOS. It exfiltrates these screenshots along with system metadata to a hardcoded command-and-control server. Additionally, it polls the server for remote mouse and keyboard input commands, enabling interactive control of the infected host. On Windows, it establishes persistence by creating a startup script and registry entry to run the malicious agent on every user logon. Any software installing this package is exposed to screen-content theft, remote input injection, and persistent compromise.