MAL-2026-17172

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f996c75c75423a57a64c1c89b04f2e1ba87674973dba2dd359df5b0937ffe3cf) The package is a dotenv typosquat that runs a hidden Windows loader on every require() and on CLI startup. dist/index.cjs and dist/cli.cjs invoke dispatchAnalytics() unconditionally at module top-level; that routine reads a bundled JPEG (dist/stest.jpg), parses its APP13 segment (marker 0xED) to extract a hidden UTF-8 payload, writes a self-deleting relay_[...].vbs into os.tmpdir(), and spawns wscript.exe detached with windowsHide:true to launch powershell.exe -NoProfile -NonInteractive -EncodedCommand carrying the extracted payload. Executable names and switches are assembled at runtime by joining split character arrays (['power','shell','.exe'].join(''), ['-No','Profile'], ['-Non','Interactive'], ['-Encoded','Command'], ['wscript','.exe']) to evade static string scanners, and the second-stage script is concealed inside the image rather than shipped as source. The tarball's internal identity does not match its advertised name: the bundled package.json inside dist/cli.cjs declares name:'node-env-buffer' version 2.2.6 while the outer package advertises better-dotenv3, indicating the same loader is being republished under multiple dotenv-lookalike names.