MAL-2026-13741 Malicious code in safe-local-env-loader (npm)

safe-local-env-loader impersonates the legitimate dotenv package: its description, repository, homepage, and lib/main.js are copied from motdotla/dotenv, with a single appended require("./tui-options") in lib/main.js that activates a hidden agent on module load. On require(), lib/tui-options.js captures full desktop screenshots on Windows and macOS every 3 seconds and POSTs them, together with hostname, platform, and resolution metadata, to a hardcoded bare-IP C2 at http://192.99.204.157:5000/upload. The same module polls http://192.99.204.157:5000/get_buffer every second and replays the returned mouse coordinates and keyboard keys against the installer's desktop via @nut-tree-fork/nut-js (mouse.setPosition/mouse.click and keyboard.pressKey), giving the remote operator interactive control of the host. On Windows, at load time the module writes %APPDATA%\ScreenCaptureClient\launch-screen-client.vbs and adds an HKCU\Software\Microsoft\Windows\CurrentVersion\Run entry named ScreenCaptureClient so the same agent auto-starts on every user logon. Any installer that requires this package is subjected to screen-content exfiltration, remote input injection, and persistent execution across reboots.