node-env-resolver-dotenvx@1.0.1

Analysis

node-env-resolver-dotenvx@1.0.1 carries a ~4.5MB obfuscated eval payload (Caesar-cipher ROT decoder wrapped in eval) in the package-root index.js. Activation is via a binding.gyp whose sources field contains the GYP command substitution '<!(node index.js > /dev/null 2>&1 && echo stub.c)', executing the payload during npm install through node-gyp configure. The legitimate dotenvx/keychain resolver code in dist/ is intact, but a worm payload was injected at the package root; the publisher deprecated this version as a compromised supply-chain build.