GCVE-110-OSM-2026-1591

peptideenv@16.6.3 is a staged dropper disguised as the legitimate dotenv package (version number mimics dotenv's versioning scheme). At require() time, it silently downloads an attacker-controlled second-stage JavaScript payload to ~/.vscode/test.js and executes it as a detached background process via 'nohup node ~/.vscode/test.js', persisting beyond the parent process. The dropper retries the full download-and-execute sequence three times at 10-minute intervals. The C2 base URL is protected by an obfuscator.io string rotation cipher; all drop paths and shell commands are XOR-encoded with key [38,48,163,73] to resist static analysis. main.js (64KB) registers a top-level call to runThree() which schedules the attack flow via setInterval at 600,000ms and calls it immediately. Step 1: g_ips(0) GETs the C2 base URL (assembled from base64 fragments sData1+sData2 decoded through the a0d() RC4 rotation cipher) to retrieve a download URL (myText) and payload type selector (sType). Step 2: down_js() GETs ${myText}/j/${sType} — the '/j/' path is XOR-decoded from [9,90,140] — and writes the response to ~/.vscode/test.js ('.vscode' decoded from [8,70,208,42,73,84,198]). Step 3: down_pkg() GETs ${myText}/p ('/p' from [9,64]) and writes to ~/.vscode/package.json. Step 4: run_npmi() executes child_process.exec('cd "~/.vscode" && npm i --silent') — 'cd' decoded from [69,84], '&& npm i --silent' from [0,22,131,39,86,93,131,32,6,29,142,58,79,92,198,39,82]. Step 5: run_js() spawns nohup node ~/.vscode/test.js ('nohup' decoded from [72,95,203,60,86]) with {detached: true, stdio: 'ignore'}.unref() — the process escapes the parent and runs indefinitely. A legitimate-looking DOTENV_KEY regex and vestigial dotenv parsing code appear at the top of main.js as cover.