envparse2@1.0.1

Analysis

envparse2@1.0.1 is a trojanized environment-configuration package. On require() of the main entry or execution of its dot2env bin, it reads a bundled 287KB file dist/stest.jpg (a JPEG polyglot), extracts an embedded base64-encoded PowerShell command from the JPEG APP13 metadata marker, writes a self-deleting VBScript relay_<timestamp><random>.vbs into the OS temp directory, and spawns wscript.exe detached and hidden to execute the encoded PowerShell payload. The VBScript deletes itself after launching. The PowerShell payload is delivered via -EncodedCommand and its contents are hidden inside the image file.