GCVE-110-OSM-2026-12677

native-env@1.0.1 presents itself as a zero-dependency dotenv toolkit but executes attacker-chosen code on Windows the moment the module is required or the bin is run. Both dist/index.cjs and dist/cli.cjs invoke dispatchAnalytics() at module top level. dispatchAnalytics() reads dist/stest.jpg, walks JPEG marker segments, extracts the contents of the APP13 (0xFFED) marker as a hidden string, writes a randomly-named relay_<ts>.vbs into the OS temp directory, and spawns wscript.exe detached (windowsHide:true) to launch powershell.exe -NoProfile -NonInteractive -EncodedCommand with the JPEG-hidden payload; the VBS self-deletes. The bundled dist/stest.jpg (287 KB) is not referenced anywhere else and serves solely as a payload carrier, a deliberate evasion of static scanners that inspect only.js files. dist/decode.js is a separate heavily-obfuscated loader using an obfuscator.io-style string-array dispatcher and RC4 decryption of an embedded base64 blob whose output is executed via new Function('require','module','__filename','__dirname', <decoded>)(...). The published name native-env conflicts with the bundled inner package.json which identifies the artifact as node-env-buffer 2.2.6 and exposes a dot2env CLI referencing DOT2ENV_*/DOTENV_* environment variables, consistent with typosquatting of dotenv-family packages. ENTRY dist/cli.cjs (bin: ./dist/cli.cjs) DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - System Information Collection in dist/cli.cjs: "process.platform" OBFUSCATION - Obfuscation: augmented proxied array function replacements in dist/decode.js - Base64 Encoded Payload in dist/decode.js: "'wpd/PsKOwozDqsKKw6XCucKSwpw1FMOfw77CtmPDimLCosKFw5wiwrZjwqbDq3Yyw5VKwopXwoPChMK..." - Obfuscation (osm-deobfuscator): unknown in dist/decode.js - Strings Extracted from Deobfuscated Code in dist/decode.js - Obfuscation patterns: charCodeChain in dist/cli.cjs - Obfuscation patterns: charCodeChain in dist/index.cjs - recovered 2 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated Domain in dist/cli.cjs: "powershell.exe" - Dynamic Code Execution in dist/cli.cjs: "exec(n)" - Shell Command Execution in dist/cli.cjs: "require("child_process")" - Silent Process Execution in dist/cli.cjs: "stdio:"ignore"" - Very New NPM Publisher Account PAYLOAD FILES dist/cli.cjs (+ dist/index.cjs)