The safe-local-env-loader npm package impersonates the legitimate dotenv package but contains malicious code that captures desktop screenshots every 3 seconds on Windows and macOS. It exfiltrates these screenshots along with system metadata to a hardcoded command-and-control server. Additionally, it polls the server for remote mouse and keyboard input commands, enabling interactive control of the infected host. On Windows, it establishes persistence by creating a startup script and registry entry to run the malicious agent on every user logon. Any software installing this package is exposed to screen-content theft, remote input injection, and persistent compromise.