0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
goodjavascript-dotenv
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting goodjavascript-dotenv, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-11212 | Unknown | Malicious code in @goodjavascript/dotenv (npm)@goodjavascript/dotenv@1.0.0 (published 2025-03-22T09:05:32Z, replaced by an npm 0.0.1-security holding stub 2026-07-30T22:47:55Z — approximately 16 months live) is a two-file package that impersonates the API of the widely used dotenv configuration loader while running a command-and-control implant. The published tarball contains only package.json (164 bytes) and index.js (840 bytes); unpacked size 1004 bytes. There is no scripts block, so there is no install hook — the implant is triggered at runtime, when the module is imported. The package declares a single runtime dependency, systeminfor |
| OSV (opens in a new tab) |
@goodjavascript/dotenv@1.0.0 (published 2025-03-22T09:05:32Z, replaced by an npm 0.0.1-security holding stub 2026-07-30T22:47:55Z — approximately 16 months live) is a two-file package that impersonates the API of the widely used dotenv configuration loader while running a command-and-control implant. The published tarball contains only package.json (164 bytes) and index.js (840 bytes); unpacked size 1004 bytes. There is no scripts block, so there is no install hook — the implant is triggered at runtime, when the module is imported. The package declares a single runtime dependency, systeminfor