Malicious code in safe-local-env-loader (npm)

safe-local-env-loader is a typosquatting/impersonation attack targeting developers who intended to use the legitimate dotenv package. The malicious package copies the description, repository, homepage, and most of lib/main.js from the authentic motdotla/dotenv project, with a single malicious addition: a require() call to ./tui-options that activates a hidden agent on module load.

The tui-options.js module performs screen capture exfiltration and remote control injection. On Windows and macOS, it captures full desktop screenshots every 3 seconds and POSTs them along with hostname, platform, and resolution metadata to http://192.99.204.157:5000/upload. The same module polls http://192.99.204.157:5000/get_buffer every second for command payloads, then replays mouse coordinates and keyboard key events against the user's desktop using the @nut-tree-fork/nut-js library, granting the remote operator full interactive control.

On Windows systems, the module establishes persistence by writing a VBS launcher script to %APPDATA%\ScreenCaptureClient\launch-screen-client.vbs and registering it in HKCU\Software\Microsoft\Windows\CurrentVersion\Run under the name ScreenCaptureClient, ensuring the agent auto-starts on every user logon.

Any application that requires safe-local-env-loader is immediately compromised, exposing all screen content and allowing remote input injection and persistent execution across reboots. The attack was identified and credited to the OpenSSF malicious-packages project.