# MAL-2026-6082: Malicious code in dotenv-sync (PyPI)


- **Type:** Malicious package
- **Package:** `dotenv-sync` (PyPI)
- **Published:** 17 Jun 2026

## What is MAL-2026-6082?

MAL-2026-6082 is a malicious package in dotenv-sync, published on 17 Jun 2026. 

### Official description

On Windows, `src/envsync/__init__.py` (lines 39-44) unconditionally calls `ctypes.CDLL` on a bundled ~2.9MB PE file `_parser.pyd` at top-level import, wrapped in `try:... except: pass`. Loading a PE via `ctypes.CDLL` invokes `LoadLibraryA`, which executes the DLL's `DllMain` entry point — arbitrary native code runs on every `import dotenv_sync` / `import envsync` with the installer's user privileges, silently. No symbol from the.pyd is ever called from Python; the sole effect of the CDLL call is to execute the binary. The package's README advertises 'zero dependencies', 'Pure Python parser', and 'nothing to audit', and a ~60-line pure-Python parser already exists in `parse.py` — so the native load is undisclosed and unnecessary for the advertised functionality. `pyproject.toml` line 78 force-includes two byte-identical copies of the PE (`_parser.pyd` and `__parser.pyd`, sha256 `b1aace6c70312a39ca39e6bba1d9abc6aaf9b23171089b1a548adc89f67f83c3`) into both the wheel and sdist; the binaries' strings show only register-save prologues with no readable text, imports, or URLs — consistent with a packed payload. There is no `Extension()`, no setuptools/maturin/cmake build configuration, and no source for the binary. The `dotenv-sync` name and `dotenv-sync`/`envsync` CLI entries impersonate the python-dotenv / dotenv-linter / npm envsync ecosystem; author is generic ('envsync contributors') and all project URLs point only at the package's own PyPI page, with no inspectable upstream.

During import, package loads embedded native extension module. This library hooks on loading, spawns a new system process and likely attempts to inject the encrypted payload in it for further execution (T1055.012). The code uses heavy analysis evasion techniques. Decrypted payload revealed capabilities to steal all kind of credentials (browsers data, AI tools, env variables, SSH keys, ...), inject code to redirect cryptocurrency transactions, spy-like activities (screenshots, keylogger) and worm-like activities using discovered GitHub tokens to publish malicious code into CI. It establishes persistence in `%LOCALAPPDATA%\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe` and also attempts to perform lateral movement in Kubernetes and AWS environments.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-syncagents

Reasons (based on the campaign):

 - native-extension

 - infostealer

 - worm

 - exfiltration-crypto

 - exfiltration-credentials

 - uses-telegram-bot

 - keylogger

 - clipboard-stealing

 - exfiltration-ssh-keys

 - The package contains code to detect if it is running in a sandbox environment.

 - obfuscation

 - exfiltration-browser-data

 - exfiltration-env-variables

 - persistence

## What should I do about MAL-2026-6082?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-6082 is a malicious package: dotenv-sync (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-6082/ (Markdown: https://insights.sbomify.com/MAL-2026-6082/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-6082

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-6082/
Summaries are generated and may contain mistakes; the official description above is the record.