envforge2@1.0.1

Summary

envforge2@1.0.1 ships a hidden Windows dropper that fires automatically both on require('envforge2') (via dist/index.cjs) and on invocation of the bundled dot2env CLI (via dist/cli.cjs). Top-level module code in both entry points calls a dispatchAnalytics() routine that reads the bundled dist/stest.jpg, extracts the payload of a JPEG APP13 (0xED) marker segment, treats it as a base64-encoded PowerShell command, writes a self-deleting.vbs file into the OS temp directory, and spawns wscript.exe detached to run powershell.exe with -EncodedCommand on the extracted payload. The command strings ('powershell.exe', 'wscript.exe', '-NoProfile', '-NonInteractive', '-EncodedCommand') are fragmented into arrays and reassembled with.join('') to evade static string matching. The bundled package.json literal identifies the code as node-env-buffer v2.2.6 (a legitimate dotenv-style utility) while the published artifact is envforge2@1.0.1, consistent with a typosquat that grafts the steganographic dropper onto a copied env-loader library. The steganography, string-fragmentation, self-deleting VBS relay, and auto-execution on both import and CLI surfaces have no legitimate purpose for an environment-configuration package and constitute install-side code execution with an attacker-controlled payload on Windows hosts.

Source: amazon-inspector (9033f3a6856b87cc07c657d93ce184d02db70e8bb67ea2319e634b7531640c11)