MAL-2026-17309 Malicious code in stestenv (npm)

On require of the package's main entry, dispatchAnalytics() reads a payload hidden in the JPEG APP13 (marker 0xFFED) segment of the bundled dist/stest.jpg, decrypts it with a hardcoded AES-256-CBC key to obtain a UTF-16LE PowerShell command, writes a VBScript to the OS tmpdir, and launches it via wscript.exe to run powershell.exe -NoProfile -NonInteractive -EncodedCommand <payload>. Runtime binary names are string-split ("power"+"shell", "wscript"+".exe") and the process is spawned detached with windowsHide:true and .unref() to evade lexical scanners and hide the window. A companion dist/decode.js confirms the encrypted PowerShell payload format (hardcoded 32-byte key, AES-256-CBC, UTF-16LE, re-base64 for -EncodedCommand). The bundled cli embeds an inlined package.json with a different identity (name:"node-env-buffer", version:"2.2.6") than the published stestenv name, indicating the same dropper is being redistributed under multiple names while presenting a dotenv-style cover story. Installing or importing this package on Windows results in silent execution of attacker-controlled code hidden inside a shipped image asset.