# MAL-2026-17237: Malicious code in native-env (npm)


- **Type:** Malicious package
- **Package:** `native-env` (npm)
- **Published:** 28 Sep 2026

## What is MAL-2026-17237?

MAL-2026-17237 is a malicious package in native-env, published on 28 Sep 2026. 

### Official description

native-env@1.0.1 presents itself as a zero-dependency dotenv toolkit but executes attacker-chosen code on Windows the moment the module is required or the bin is run. Both dist/index.cjs and dist/cli.cjs invoke dispatchAnalytics() at module top level. dispatchAnalytics() reads dist/stest.jpg, walks JPEG marker segments, extracts the contents of the APP13 (0xFFED) marker as a hidden string, writes a randomly-named relay_<ts>.vbs into the OS temp directory, and spawns wscript.exe detached (windowsHide:true) to launch powershell.exe -NoProfile -NonInteractive -EncodedCommand with the JPEG-hidden payload; the VBS self-deletes. The bundled dist/stest.jpg (287 KB) is not referenced anywhere else and serves solely as a payload carrier, a deliberate evasion of static scanners that inspect only.js files. dist/decode.js is a separate heavily-obfuscated loader using an obfuscator.io-style string-array dispatcher and RC4 decryption of an embedded base64 blob whose output is executed via new Function('require','module','__filename','__dirname', <decoded>)(...). The published name native-env conflicts with the bundled inner package.json which identifies the artifact as node-env-buffer 2.2.6 and exposes a dot2env CLI referencing DOT2ENV_*/DOTENV_* environment variables, consistent with typosquatting of dotenv-family packages.

## What should I do about MAL-2026-17237?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-17237 is a malicious package: native-env (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-17237/ (Markdown: https://insights.sbomify.com/MAL-2026-17237/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-17237

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-17237/
Summaries are generated and may contain mistakes; the official description above is the record.