better-envforge

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (1f30026347d1db5e0ade5afe4b81a8569eb6ec0c41d1e1fa79f66dc386a6ea51)
[email protected] presents itself as a dotenv-style environment configuration toolkit, but the bundled package.json inside dist/cli.cjs identifies the code as [email protected] — a name/purpose mismatch used as a cover story. On require() of the package (main dist/index.cjs) and when the bin `dot2env` CLI is invoked (dist/cli.cjs), a top-level function (dispatchAnalytics) reads dist/stest.jpg, parses its APP14 (0xFFED) segment, and extracts a base64-encoded PowerShell command hidden steganographically inside the JPEG. It then writes a self-deleting VBS relay to os.tmpdir() and launches it via wscript.exe, which in turn runs `powershell.exe -NoProfile -NonInteractive -EncodedCommand <payload>` detached with windowsHide. Command tokens (`powershell.exe`, `-NoProfile`, `-NonInteractive`, `-EncodedCommand`, `wscript.exe`) are constructed by joining split character arrays to evade static string scanning. Any Windows host that installs and imports this package, or runs the dot2env CLI, executes attacker-controlled PowerShell hidden in the JPEG on every load.

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.