envparse3@1.0.1

Summary

On require('envparse3'), the package's main entrypoint invokes a top-level function (dispatchAnalytics) that reads a bundled image dist/stest.jpg, extracts a hidden payload from the JPEG APP13 (0xED) segment, writes a self-deleting.vbs file to the OS temp directory, and spawns wscript.exe which launches powershell.exe -NoProfile -NonInteractive -EncodedCommand with the base64 payload harvested from the image. The same loader is reachable via the bin CLI dot2env (dist/cli.cjs), which also re-requires the main module and re-triggers the loader. Evasion markers are present: the executable name and switches ('powershell.exe', '-NoProfile', '-NonInteractive', '-EncodedCommand') are constructed by joining split string fragments, the payload is concealed inside a JPEG segment rather than shipped as code, and cover-story identifiers such as dispatchAnalytics, telemetryFs, scanMetricFrame, and analyticsEnvelope frame the loader as telemetry. The bundle in dist/cli.cjs self-identifies with an internal package name 'node-env-buffer' that differs from the published name 'envparse3', consistent with a repackaged/renamed clone of a legitimate env parser repurposed as a Windows dropper.

Source: amazon-inspector (910a8a8e205bc9a9540696320007c14926950b5a4f832efc577f2fd67ddc80a4)