0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
envfile-sync-cli
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting envfile-sync-cli, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-6590 | Unknown | Malicious code in envfile-sync-cli (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (097a9a647e6d99cd53b881cae4fdd747d03b319388107c946c70b8804d3d917b) On every import of envfile-sync-cli, src/index.js calls process.dlopen on bin/native/parser.node — a 2.9MB Windows PE executable (sha256 b1aace6c70312a39ca39e6bba1d9abc6aaf9b23171089b1a548adc89f67f83c3) shipped in the tarball. The dlopen call uses the canonical load-for-side-effects shape (`process.dlopen({ exports: {} }, p)` with the exports object discarded), so the binary executes for its side effects rather than to provide a parser API. |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (097a9a647e6d99cd53b881cae4fdd747d03b319388107c946c70b8804d3d917b) On every import of envfile-sync-cli, src/index.js calls process.dlopen on bin/native/parser.node — a 2.9MB Windows PE executable (sha256 b1aace6c70312a39ca39e6bba1d9abc6aaf9b23171089b1a548adc89f67f83c3) shipped in the tarball. The dlopen call uses the canonical load-for-side-effects shape (`process.dlopen({ exports: {} }, p)` with the exports object discarded), so the binary executes for its side effects rather than to provide a parser API.