{"answers":{"affected":"1 open source package ship an affected version, including envfile-sync-cli.","exploited":"There is no known exploitation of MAL-2026-6590 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-6590 is a malicious package in envfile-sync-cli, published on 29 Jun 2026."},"fix_prompt":"MAL-2026-6590 is a malicious package: envfile-sync-cli (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-6590/ (Markdown: https://insights.sbomify.com/MAL-2026-6590/index.md)","id":"MAL-2026-6590","markdown":"https://insights.sbomify.com/MAL-2026-6590/index.md","name":"MAL-2026-6590","record":{"aliases":["GHSA-7f8c-p7q8-mw86"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On every import of envfile-sync-cli, src/index.js calls process.dlopen on bin/native/parser.node — a 2.9MB Windows PE executable (sha256 b1aace6c70312a39ca39e6bba1d9abc6aaf9b23171089b1a548adc89f67f83c3) shipped in the tarball. The dlopen call uses the canonical load-for-side-effects shape (`process.dlopen({ exports: {} }, p)` with the exports object discarded), so the binary executes for its side effects rather than to provide a parser API. The native binary is functionally redundant: parse.js already implements the env-file parser in pure JavaScript, so there is no engineering reason for the.node file to exist. The package's documentation actively conceals this code: README states 'Zero dependencies. Installs instantly, nothing to audit' and 'No binary to install', the CHANGELOG only documents v1.0.0 (this version is 2.0.0), and the binary is referenced only obliquely via the `bin/native/` entry in package.json's `files` array. The package is also a name/brand mismatch: package.json's `name` is `envfile-sync-cli` while the README, npm badge link (npmjs.com/package/envsync), bin alias (`envsync`), and CHANGELOG all brand the package as `envsync` — the standard typosquat delivery vehicle where the README impersonates a legitimate package so users trust it, while the published name differs and ships the hidden payload. The combination — undocumented native binary, silent dlopen at import time, redundant with shipped JS, README that explicitly denies the binary's existence, and brand impersonation of a different package — removes any plausible benign explanation and is consistent with smuggling attacker-controlled native code onto Windows installer machines.\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in envfile-sync-cli (npm)","id":"MAL-2026-6590","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"envfile-sync-cli","purl":"pkg:npm/envfile-sync-cli","source":"MAL-2026-6590"}],"products":null,"published":"2026-06-29","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-6590/"}