Suspicious 80% javascript Download

dotenv-async 1.0.0

Typosquat with hidden VBS malware

“A fast, validated, zero-dependency environment configuration toolkit for Node.js”

Staged FSO deletes its source scriptEncodedCommand switch split across array items
SHA-2565c3a8ef4878b68318b116c3e9935ca581fbac3a0b30566383a144f65accb9b34
URLhttps://registry.npmjs.org/dotenv-async/-/dotenv-async-1.0.0.tgz
MaleculeO₅(As₄CIS₂Xe)H₇(F₆Cm₂CrDb₁₅Os₅Po₁₇U)Md₄(In₅Pa₁₀)

Also flagged by osm (Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code.), osv (MAL-2026-17504: Malicious code in dotenv-async (npm)) +4 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.