envfile-sync-cli@1.0.2

Analysis

Package advertises itself as a zero-dependency .env-to-.env.example sync/validation CLI, and indeed ships a complete pure-JavaScript .env parser that does all of the advertised work. Hidden at the end of its main module (src/index.js) is a module-load-time block that resolves bin/native/parser.node and calls process.dlopen on it inside a nested try/catch that silently swallows every error and discards the result. The comment claims this is a native parser loaded for performance, but the parser is implemented entirely in JavaScript and the loaded binary is never used. The bundled bin/native/parser.node is not a Node native addon at all but a Windows PE executable, so on Windows simply importing the package (or running its CLI) loads and executes attacker-controlled native code with no further interaction. The package was freshly published from a disposable email account and stuffed with dotenv/env-sync keywords to attract installs.