[email protected] is a malicious npm package that executes arbitrary code on Windows systems as soon as it is loaded or its CLI is run. It achieves this by reading a hidden payload embedded in a JPEG file (dist/stest.jpg) within the package, writing a randomly named VBScript file to the OS temporary directory, and launching it via wscript.exe to run a PowerShell command with an encoded payload. The VBScript self-deletes after execution. The package uses obfuscated JavaScript code with RC4 decryption to load and execute the payload. The package name conflicts with an inner package.json identifying it as node-env-buffer 2.2.6 and exposes a CLI referencing environment variables consistent with typosquatting attempts on popular dotenv packages.

This package allows execution of arbitrary attacker-chosen code on Windows systems immediately upon installation or use, potentially leading to full system compromise or further malicious activity. The use of obfuscation and payload hiding techniques increases the difficulty of detection by static analysis tools.

No official patch or fix is available for this malicious package. The recommended mitigation is to avoid installing or using [email protected] and to verify package authenticity before installation. Users should remove this package if present and rely only on trusted and verified dotenv packages from official sources.