MAL-2026-3759 Malicious code in env-threads (npm)

Package env-threads impersonates the legitimate dotenv package: its README, repository URL (git://github.com/motdotla/dotenv.git), homepage, description, keywords (dotenv, env, .env, environment, variables, config, settings), and public API surface (config, parse, populate) are copied from dotenv, but the package name differs. Unlike genuine dotenv — a small unobfuscated pure-JS parser — this package ships an 82 KB heavily obfuscated lib/main.js with hex-named identifiers and a string-array decoder (xIuLO2(0x...)). At module top level, the last executable statement runs SbEjWpp(path.join(__dirname, <decoded-filename>)), which resolves to lib/stest.jpg. The SbEjWpp function calls fs.readFileSync on that file and extracts an embedded payload via steganographic decoding, then executes it through child_process. Every consumer who adds env-threads to their dependency tree and requires it — typically expecting dotenv-like behavior — triggers arbitrary code execution from a payload hidden inside a JPEG shipped in the tarball. The combination of (1) verbatim typosquat of a top-tier npm package, (2) heavy obfuscation absent from the impersonated original, and (3) child_process execution of steganographically-hidden bytes at require-time is unambiguous supply-chain malware.