# MAL-2026-17324: Malicious code in dotenv-preflight (npm)


- **Type:** Malicious package
- **Package:** `dotenv-preflight` (npm)
- **Published:** 29 Sep 2026

## What is MAL-2026-17324?

MAL-2026-17324 is a malicious package in dotenv-preflight, published on 29 Sep 2026. 

### Official description

The npm package dotenv-preflight@1.0.0 presents itself as a dotenv-related preflight utility but ships a single index.js whose contents are heavily obfuscated (hex-prefixed identifiers such as _0x351140, _0x3256d4, _0x3de8a6, _0x2a9875, _0x4d88e3 on line 1, consistent with javascript-obfuscator string-array output). Legitimate dotenv/env-preflight tooling is a few dozen lines of readable JavaScript; wrapping the entire module in a string-array obfuscator has no benign purpose for a package in this category and is the standard concealment technique used to hide credential-harvesting and network exfiltration behavior from casual review. The package name closely resembles the popular dotenv ecosystem, increasing the chance of accidental installation, and the obfuscated body would execute on require() by any consumer that adds this dependency. Semantic tracing of the obfuscated code triggered the provider's malware-output safety filter, which is characteristic of operational credential-theft or exfiltration payloads rather than routine business logic.

The OpenSSF Package Analysis project identified 'dotenv-preflight' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

## What should I do about MAL-2026-17324?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-17324 is a malicious package: dotenv-preflight (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-17324/ (Markdown: https://insights.sbomify.com/MAL-2026-17324/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-17324

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-17324/
Summaries are generated and may contain mistakes; the official description above is the record.