{"answers":{"affected":"1 open source package ship an affected version, including envfile-sync.","exploited":"There is no known exploitation of MAL-2026-6589 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-6589 is a malicious package in envfile-sync, published on 29 Jun 2026."},"fix_prompt":"MAL-2026-6589 is a malicious package: envfile-sync (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-6589/ (Markdown: https://insights.sbomify.com/MAL-2026-6589/index.md)","id":"MAL-2026-6589","markdown":"https://insights.sbomify.com/MAL-2026-6589/index.md","name":"MAL-2026-6589","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"Package name is 'envfile-sync' but every user-facing artifact (README title, bin name, homepage, repository, bugs URL, badges, keywords, CHANGELOG) brands the package as 'envsync', a lookalike of an unrelated existing npm package. The advertised JS API is non-functional: exported sync/check/validate/init in src/index.js return hardcoded placeholders ({ ok: true, missing: [],...opts }) and never set the fields (r.added, r.example, r.inSync, r.createdExample) that bin/cli.js consumes — the documented surface is a stub. On module load, src/index.js:21-25 resolves bin/native/parser.node and calls process.dlopen(module, p), executing arbitrary native code from a 2.9MB undocumented Windows PE ('!This program cannot be run in DOS mode.'). The README explicitly denies any binary exists ('zero dependencies', 'No binary to install, nothing to audit'), and no JS export ever calls into a native parser API, so the binary's behavior is hidden from auditors and contradicts the package's documentation. The combination — typosquat branding to attract installs, stub JS to satisfy a casual reader, opaque native PE dlopen'd on import as the only real code path — is the canonical hidden-native-payload shape. Any consumer who imports envfile-sync on Windows runs the unverifiable native code with the host process's privileges.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in envfile-sync (npm)","id":"MAL-2026-6589","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"envfile-sync","purl":"pkg:npm/envfile-sync","source":"MAL-2026-6589"}],"products":null,"published":"2026-06-29","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-6589/"}