@apollolibraryorg/dotenv@1.0.2

Analysis

@apollolibraryorg/dotenv is a trojanized clone of the dotenv package. It ships the genuine dotenv source (README, lib/main.js, BSD-2-Clause license) but adds a runtime dependency on @uallianceorg/config and injects a call to that dependency's loadConfig() as the first statement of configDotenv() in lib/main.js. When a consumer requires the package and calls dotenv.config() — its advertised function — the injected call runs @uallianceorg/config's lib/load.js, an obfuscated loader (string-array/rotation obfuscation with a custom decoder) that base64-decodes and fetches hxxps://sideggs[.]art/downloads/script and executes the returned JavaScript with new Function('exports','require', body), giving the remote host arbitrary code execution in the installer's process. The base64 URL is assembled from obfuscated fragments so the destination does not appear in plaintext. IOCs: hxxps://sideggs[.]art/downloads/script (domain sideggs[.]art).