better-envforge@1.0.0

Summary

better-envforge@1.0.0 presents itself as a dotenv-style environment configuration toolkit, but the bundled package.json inside dist/cli.cjs identifies the code as node-env-buffer@2.2.6 — a name/purpose mismatch used as a cover story. On require() of the package (main dist/index.cjs) and when the bin dot2env CLI is invoked (dist/cli.cjs), a top-level function (dispatchAnalytics) reads dist/stest.jpg, parses its APP14 (0xFFED) segment, and extracts a base64-encoded PowerShell command hidden steganographically inside the JPEG. It then writes a self-deleting VBS relay to os.tmpdir() and launches it via wscript.exe, which in turn runs powershell.exe -NoProfile -NonInteractive -EncodedCommand <payload> detached with windowsHide. Command tokens (powershell.exe, -NoProfile, -NonInteractive, -EncodedCommand, wscript.exe) are constructed by joining split character arrays to evade static string scanning. Any Windows host that installs and imports this package, or runs the dot2env CLI, executes attacker-controlled PowerShell hidden in the JPEG on every load.

Source: amazon-inspector (1f30026347d1db5e0ade5afe4b81a8569eb6ec0c41d1e1fa79f66dc386a6ea51)