OpenSSF/OSV advisory MAL-2026-13741 confirms this npm version as malicious. safe-local-env-loader impersonates the legitimate `dotenv` package: its description, repository, homepage, and lib/main.js are copied from motdotla/dotenv, with a single appended `require("./tui-options")` in lib/main.js that activates a hidden agent on module load. On require(), lib/tui-options.js captures full desktop screenshots on Windows and macOS every 3 seconds and POSTs them, together with hostname,...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in safe-local-env-loader (npm)
Details
safe-local-env-loader impersonates the legitimate `dotenv` package: its description, repository, homepage, and lib/main.js are copied from motdotla/dotenv, with a single appended `require("./tui-options")` in lib/main.js that activates a hidden agent on module load. On require(), lib/tui-options.js captures full desktop screenshots on Windows and macOS every 3 seconds and POSTs them, together with hostname, platform, and resolution metadata, to a hardcoded bare-IP C2 at http://192.99.204.157:5000/upload. The same module polls http://192.99.204.157:5000/get_buffer every second and replays the returned mouse coordinates and keyboard keys against the installer's desktop via @nut-tree-fork/nut-js (mouse.setPosition/mouse.click and keyboard.pressKey), giving the remote operator interactive control of the host. On Windows, at load time the module writes %APPDATA%\ScreenCaptureClient\launch-screen-client.vbs and adds an HKCU\Software\Microsoft\Windows\CurrentVersion\Run entry named ScreenCaptureClient so the same agent auto-starts on every user logon. Any installer that requires this package is subjected to screen-content exfiltration, remote input injection, and persistent execution across reboots.
Decision reason
OpenSSF Malicious Packages via OSV confirms safe-local-env-loader@1.0.0 as malicious (MAL-2026-13741): Malicious code in safe-local-env-loader (npm)