node-env-resolver-vite@2.4.2

Analysis

A supply-chain compromised package. An attacker injected a 4.5MB obfuscated eval-based payload into ./package/index.js and weaponized a binding.gyp file that uses the GYP <!(...) syntax to silently execute 'node index.js > /dev/null 2>&1' during npm install (no lifecycle script needed). The legitimate package code (dist/index.js, a clean 1.6KB Vite env-resolver plugin) remains intact, indicating the compromise was via injected files. The version was deprecated with the note 'SECURITY: compromised supply-chain build (2026-06-04 worm)'. The obfuscated eval decoder applies a Caesar-cipher transform to a character-code array and evals the result; the worm payload activates during install via the binding.gyp vector.