peptideenv@16.6.6

Analysis

peptideenv@16.6.6 is a combosquat of the popular dotenv package (same description, same repo URL fraudulently claimed, version 16.6.6 matching dotenv's version series). The publisher (richswift225) previously published the confirmed-malicious js-unimode. The main entry point is heavily obfuscated with javascript-obfuscator and contains a multi-stage C2 backdoor that fires immediately on require(): it contacts a C2 server on port 1244 (reconstructed from obfuscated base64), transmits a system fingerprint (hostname, platform, username, node version) via POST with fields ts/type/hid/ss/cc, then downloads and executes secondary JS payloads saved to ~/.vscode/*.fjs, followed by downloading npm packages and running them via detached node/nohup processes. The attack retries up to 3 times at ~10-minute intervals. The package also contains a copy of dotenv's legitimate parse() function at the bottom of the file to disguise its behavior.