The npm package envfile-sync-cli contains a malicious native Windows binary that is loaded silently on import. This binary is redundant with existing JavaScript code and is concealed by misleading documentation and branding that impersonates a different package. The package ships attacker-controlled native code disguised to evade detection, indicating a supply chain compromise via a typosquatting attack.