The npm package native-env@1.0.1 is a malicious package masquerading as a zero-dependency dotenv toolkit. On Windows, it executes attacker-controlled code immediately upon being required or run. It uses a JPEG file as a payload carrier to evade static scanners, writes a VBScript to the temp directory, and launches a PowerShell command with an encoded payload. The package is a typosquatting attempt targeting dotenv-family packages.