envforge3@1.0.1

Analysis

envforge3@1.0.1 is a dotenv-style environment toolkit that executes a hidden multi-stage Windows payload at module load. When the package is required (dist/index.cjs) or its CLI is run (dist/cli.cjs), it reads the bundled file dist/stest.jpg (a 287KB file disguised as a JPEG), extracts an embedded base64-encoded PowerShell command from the JPEG's APP1 metadata segment, and writes a self-deleting VBScript relay script (relay_<timestamp>_<random>.vbs) into the system temp directory. That relay launches powershell.exe with -NoProfile -NonInteractive -EncodedCommand <payload> hidden (window style 0) via wscript.exe, spawned detached so it runs in the background. The final PowerShell stage is base64-encoded and not visible in the source; the package's stated purpose (env parsing) does not require spawning PowerShell or wscript on install/require.