envparse2@1.0.1

Summary

On require() of the package's main entry and on invocation of the dot2env CLI, the module reads the bundled dist/stest.jpg, parses JPEG markers, and extracts a UTF-8 string from the APP13 (0xED) segment. The extracted string is passed as an argument to powershell.exe -NoProfile -NonInteractive -EncodedCommand, launched hidden on Windows via a VBS relay dropped to %TMP% and invoked through wscript.exe. The invocation is assembled from split string fragments (['power','shell','.exe'].join(''), -Encoded+Command, wscript+.exe) to hide the command from static scanners, and identifiers use a telemetry/analytics cover story (telemetryFs, dispatchAnalytics, analyticsEnvelope, scanMetricFrame). Execution is triggered unconditionally by a top-level const {dispatchAnalytics:Re}=T(); Re(); in dist/index.cjs. The bundle also embeds a package.json fragment declaring name: 'node-env-buffer', version: '2.2.6' while the tarball is published as envparse2@1.0.1, indicating a renamed republish under a dotenv-style cover identity. The 287 KB JPEG has no legitimate role in a dotenv-style library; it is a container for the executable payload.

Source: amazon-inspector (59aed7381a2a7026336f5e79671e05e9313688533ca35e15cf7010a975c2c897)