{"answers":{"affected":"1 open source package ship an affected version, including @js-lib-team/env-parser.","exploited":"There is no known exploitation of MAL-2026-14344 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14344 is a malicious package in @js-lib-team/env-parser, published on 21 Aug 2026."},"fix_prompt":"MAL-2026-14344 is a malicious package: @js-lib-team/env-parser (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14344/ (Markdown: https://insights.sbomify.com/MAL-2026-14344/index.md)","id":"MAL-2026-14344","markdown":"https://insights.sbomify.com/MAL-2026-14344/index.md","name":"MAL-2026-14344","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package @js-lib-team/env-parser is advertised as an environment-variable parser but on require/import executes a top-level IIFE in index.js that reads the installer's local.env file, extracts values matching PRIVATE_KEY / SECRET / MNEMONIC via a 64-hex regex, and uses those keys to construct ethers.Wallet instances that sign and broadcast transactions transferring native-token balances (ETH/BNB/Polygon/Avalanche and other supported chains) from the installer's wallets to five hardcoded attacker-controlled destination addresses, including 0x70951410C5E9E938D8715288A7229548287a1a62 and bc1q4h4a2sjf4k9quhx7xrajfgcsaz082cv5h3g8dt. The load-time routine also sets process.title to 'systemd: [logrotate]' to disguise the Node process in ps/top output and ships helper stubs labelled 'Process Hiding \u0026 Persistence' and 'Polymorphic \u0026 Encryption Layers'. The declared parser purpose is a cover story; the actual behavior on module load is theft of installer-owned wallet key material and direct movement of funds to attacker addresses.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in @js-lib-team/env-parser (npm)","id":"MAL-2026-14344","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"@js-lib-team/env-parser","purl":"pkg:npm/%40js-lib-team/env-parser","source":"MAL-2026-14344"}],"products":null,"published":"2026-08-21","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14344/"}