env-drift-check@0.4.0

No blocking static signals were detected.

Run `env-drift-check audit` in a directory containing an attacker-controlled, specially named .env.* file.

Arbitrary shell command execution with the invoking user's privileges.

Unsafely interpolated filename passed to execSync shell commands.

Source inspection found a concrete user-triggered command-injection flaw in the audit feature, but no malicious lifecycle behavior, remote payload, or secret exfiltration. Flag as a critical vulnerability rather than malicious intent.