The safe-local-env-loader npm package (version 1.0.0) is a malicious package that impersonates the legitimate dotenv package by copying its description, repository, homepage, and main code, with an added require call to a hidden module (lib/tui-options.js). This hidden module captures full desktop screenshots every 3 seconds on Windows and macOS and sends them to a hardcoded IP address (http://192.99.204.157:5000/upload). It also polls the same server for mouse and keyboard commands, which it replays on the infected machine using the @nut-tree-fork/nut-js library, allowing remote interactive control. On Windows, it achieves persistence by writing a VBScript to %APPDATA% and adding a registry Run key to execute on user logon. This results in continuous screen-content exfiltration, remote input injection, and persistent execution on affected hosts.

This malicious package enables attackers to continuously capture sensitive screen content and system metadata, exfiltrate this data to a remote server, and remotely control the victim's mouse and keyboard inputs. The persistence mechanism on Windows ensures the malware runs after system reboots, increasing the risk of prolonged unauthorized access and data theft. Any software depending on this package is compromised, potentially exposing sensitive information and allowing attacker manipulation of the host environment.

No official patch or remediation is currently documented for this malicious package. The best mitigation is to avoid using the safe-local-env-loader package entirely. Verify package authenticity before installation, prefer official and well-maintained packages such as the legitimate dotenv, and monitor for unexpected dependencies. Remove any installations of safe-local-env-loader version 1.0.0 immediately and investigate affected systems for signs of compromise, including persistence artifacts and network connections to the indicated IP address.