MAL-2026-11212

@goodjavascript/dotenv@1.0.0 (published 2025-03-22T09:05:32Z, replaced by an npm 0.0.1-security holding stub 2026-07-30T22:47:55Z — approximately 16 months live) is a two-file package that impersonates the API of the widely used dotenv configuration loader while running a command-and-control implant.

The published tarball contains only package.json (164 bytes) and index.js (840 bytes); unpacked size 1004 bytes. There is no scripts block, so there is no install hook — the implant is triggered at runtime, when the module is imported. The package declares a single runtime dependency, systeminformation@^5.25.11.

index.js exports { config: () => {} }, a no-op stub matching real dotenv's config() entry point, so a caller doing require('@goodjavascript/dotenv').config() observes no error and no effect.

At module load the file registers setInterval(..., 10000).unref(). The .unref() prevents the timer from holding the Node event loop open, so a host process still exits normally and the implant does not hang builds or short-lived scripts.

The beacon uses a bare global fetch and the package declares no engines constraint, so the network activity below occurs on Node runtimes that expose a global fetch (Node 18 and later). On each 10-second tick:

1. systeminformation.getStaticData() collects a full static host profile (OS, hardware, network, UUIDs).
2. The entire profile is POSTed as JSON to http://45.9.148.93/get/<system.uuid.os> — plain HTTP, hardcoded IPv4, no TLS. The OS UUID in the path serves as a per-host identifier.
3. The response is parsed as JSON. If the field res.cute is present, it is treated as JavaScript source and executed: vm.createContext(ctx) followed by new vm.Script(res.cute).runInContext(ctx), where ctx is { res: <callback>, ...global }. Spreading global into the context gives the delivered code access to the host's Node globals. This is arbitrary remote code execution under the operator's control.
4. Delivered code may call res(data) — the callback...