The npm package dotenv-native (version 1.0.1) is a malicious typosquat of the popular dotenv package family. It executes attacker-controlled code on module load by extracting and decoding a hidden payload from a bundled JPEG file, writing a VBScript file, and launching PowerShell with an encoded command on Windows hosts. The package also includes an obfuscated decode-and-eval remote code execution primitive. Both requiring the package as a dependency or running its CLI triggers the malicious payload.