@weirdorg/dotenv@1.0.4

Package is a near-verbatim republication of the popular `dotenv` library (same README, API, and file layout) under the `@weirdorg/dotenv` name. The only material divergence from upstream `dotenv` is in `lib/main.js`: line 5 adds `const vconfig = require('@weirdorg/config')`, and line 253 inserts `vconfig.loadConfig();` at the top of `configDotenv()` — the function reached through the public `config()` entry point and through `require('@weirdorg/dotenv/config')`. `@weirdorg/config` is declared as a runtime dependency but is not mentioned in the README, is not part of the upstream `dotenv` API surface, and serves no documented purpose. Any installer who substitutes this package for `dotenv` (whether by typo, lockfile confusion, or scope-bait) and calls the advertised API will silently execute arbitrary code from `@weirdorg/config`, a sibling package controlled by the same publisher. This is the canonical namespace-abuse / dependency-smuggling shape: the visible package looks identical to a trusted library, while the actual payload lives in an undocumented sibling pulled in transparently through `dependencies`.