node-env-resolver@6.5.1

Analysis

node-env-resolver@6.5.1 is a supply-chain-compromised release whose ~4.5MB dist/index.js (the main entry) contains only obfuscated malware: try{eval(Caesar-cipher-decoder(huge-char-code-array))}, a ROT-n decoder wrapping a large character-code array. No legitimate code exists in index.js; the real resolver sits in separate chunk files as camouflage. The publisher deprecated this version as a compromised supply-chain build. On require/import, the eval executes automatically and runs the decoded second-stage payload.