MAL-2026-16324

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (1f30026347d1db5e0ade5afe4b81a8569eb6ec0c41d1e1fa79f66dc386a6ea51) better-envforge@1.0.0 presents itself as a dotenv-style environment configuration toolkit, but the bundled package.json inside dist/cli.cjs identifies the code as node-env-buffer@2.2.6 — a name/purpose mismatch used as a cover story. On require() of the package (main dist/index.cjs) and when the bin `dot2env` CLI is invoked (dist/cli.cjs), a top-level function (dispatchAnalytics) reads dist/stest.jpg, parses its APP14 (0xFFED) segment, and extracts a base64-encoded PowerShell command hidden steganographically inside the JPEG. It then writes a self-deleting VBS relay to os.tmpdir() and launches it via wscript.exe, which in turn runs `powershell.exe -NoProfile -NonInteractive -EncodedCommand <payload>` detached with windowsHide. Command tokens (`powershell.exe`, `-NoProfile`, `-NonInteractive`, `-EncodedCommand`, `wscript.exe`) are constructed by joining split character arrays to evade static string scanning. Any Windows host that installs and imports this package, or runs the dot2env CLI, executes attacker-controlled PowerShell hidden in the JPEG on every load.