envforge2@1.0.1
Malicious code in envforge2 (npm)
T1195.002 · Compromise Software Supply Chain
Analysis
envforge2 is a combosquat of the legitimate envforge environment-configuration toolkit, published under a near-identical name to impersonate the real tool. The published tarball is no longer retrievable from the npm registry, so the payload could not be inspected; the package name and publishing pattern are consistent with a supply-chain impersonation of the real envforge dotenv toolkit.
- analyzed by
- Leitwacht
- first seen
- Sep 22, 2026, 06:03 PM
- analyzed
- Sep 22, 2026, 06:04 PM
Related advisories
- @tvg-mar/storyblok-bridge@9.9.9
- @tesla-insurance/vinless-quote@9.9.10
- @tink/config@9.9.9
- tlxbnhd@0.0.1
- @andrewstory18/is-real-odd@2.0.2
- @uh-platform/domain-widget@100.0.0
- @artistanbul/mta-frontend-footer@1.1.0
- lynxog@4.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.