Suspicious 80% javascript Download

dotenv-precheck 1.0.0

Obfuscated credential stealer

“Runs dotenv preflight checks at install time”

JavaScript Obfuscator rotates and decodes a string array at runtimeNode developer secret regex list
SHA-256d080c79d0c8da50b03ab4cd5c28e10f0da4e2940deb2ffff88dccfa0b67f1b19
URLhttps://registry.npmjs.org/dotenv-precheck/-/dotenv-precheck-1.0.0.tgz
MaleculeO₄(As₄EuS₃Xe)H₆(Cm₃CrDb₉FOsPo)Md₃(In₂Pa₃)Th

Also flagged by osv (MAL-2026-17304: Malicious code in dotenv-precheck (npm)) +5 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.