node-env-resolver-nextjs@7.4.2

Analysis

node-env-resolver-nextjs@7.4.2 is a supply-chain worm: a 4.5MB single index.js wrapped entirely in a Caesar-cipher eval decoder (eval + replace(/[a-zA-Z]/g, ROT-shift) over a large encoded array) that hides the full payload from static analysis. It was published via a compromised GitHub Actions OIDC trusted-publisher pipeline, and the worm activates on require()/import with no lifecycle hooks. The publisher deprecated this version as a compromised supply-chain build.