GCVE-110-OSM-2026-12404

This package includes a malicious Windows downloader concealed in a JPEG metadata segment. Importing the package triggers it automatically; on normal module loading, the launcher is invoked twice. better-envforge@1.0.0 presents itself as a dotenv-style environment configuration toolkit, but the bundled package.json inside dist/cli.cjs identifies the code as node-env-buffer@2.2.6 — a name/purpose mismatch used as a cover story. On require() of the package (main dist/index.cjs) and when the bin `dot2env` CLI is invoked (dist/cli.cjs), a top-level function (dispatchAnalytics) reads dist/stest.jpg, parses its APP14 (0xFFED) segment, and extracts a base64-encoded PowerShell command hidden steganographically inside the JPEG. It then writes a self-deleting VBS relay to os.tmpdir() and launches it via wscript.exe, which in turn runs `powershell.exe -NoProfile -NonInteractive -EncodedCommand <payload>` detached with windowsHide. Command tokens (`powershell.exe`, `-NoProfile`, `-NonInteractive`, `-EncodedCommand`, `wscript.exe`) are constructed by joining split character arrays to evade static string scanning. Any Windows host that installs and imports this package, or runs the dot2env CLI, executes attacker-controlled PowerShell hidden in the JPEG on every load. ENTRY dist/cli.cjs (bin: ./dist/cli.cjs) DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - System Information Collection in dist/cli.cjs: "process.platform" OBFUSCATION - Obfuscation patterns: charCodeChain in dist/cli.cjs - Obfuscation patterns: charCodeChain in dist/index.cjs - recovered 2 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated Domain in dist/cli.cjs: "powershell.exe" - Dynamic Code Execution in dist/cli.cjs: "exec(n)" - Shell Command Execution in dist/cli.cjs: "require("child_process")" - Silent Process Execution in dist/cli.cjs: "stdio:"ignore"" - Very New NPM Publisher Account PAYLOAD FILES dist/cli.cjs (+ dist/index.cjs, dist/decode.js)