Are you testing the module and script in the same environment? If you run the script command-line, and run the module under Apache context, %ENV will and should vary.

Your code may be localizing some values of %ENV. This is actually a good security practice, since it's a potential exploit channel. See perlsec.