dotenv-pack@2.3.5

Analysis

Combosquat of "dotenv" (versions 2.3.5, 2.3.7, 2.3.10). index.js spawns a detached child running lib/initializeCaller.js, an IIFE that exfiltrates the full process environment ({ ...process.env }, including NPM_TOKEN, GITHUB_TOKEN, etc.) via axios POST to a base64-decoded C2 (ipcheck-hashed[.]vercel[.]app), then executes the server response via new Function("require", response.data) for full remote code execution. Uses the fake author "Robert King" and a jsonspack[.]com URL.