safe-local-env-loader@1.0.0

Analysis

safe-local-env-loader@1.0.0 is a dotenv clone that bundles a remote-access trojan executed on require. lib/tui-options.js captures the victim's screen (Windows via screenshot-desktop+sharp, macOS via screencapture) and POSTs the compressed image to hxxp://192[.]99[.]204[.]157:5000/upload, sending the computer hostname, platform, and display resolution in request headers. It polls hxxp://192[.]99[.]204[.]157:5000/get_status and /get_buffer every 1-3 seconds to receive remote mouse-move/click and keyboard-press commands, which it executes on the host via the nut-js input library. On Windows it installs persistence by writing a VBS launcher to %APPDATA%\ScreenCaptureClient\launch-screen-client.vbs and registering a HKCU\Software\Microsoft\Windows\CurrentVersion\Run "ScreenCaptureClient" entry so the client relaunches at login. C2: 192[.]99[.]204[.]157:5000 (paths /upload, /get_status, /get_buffer).