LWA-2026-12331 MAL-2026-16392 ↗ confirmed malware

envforge2@1.0.1

Malicious code in envforge2 (npm)

T1195.002 · Compromise Software Supply Chain

Analysis

envforge2 is a combosquat of the legitimate envforge environment-configuration toolkit, published under a near-identical name to impersonate the real tool. The published tarball is no longer retrievable from the npm registry, so the payload could not be inspected; the package name and publishing pattern are consistent with a supply-chain impersonation of the real envforge dotenv toolkit.

analyzed by
Leitwacht
first seen
Sep 22, 2026, 06:03 PM
analyzed
Sep 22, 2026, 06:04 PM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.