calendar-day-kit@1.0.0

High-risk behavior combination matched malicious policy.

Runtime import of calendar-day-kit on Linux with /mnt/c and a qualifying Windows user profile, outside NODE_ENV=production.

Unconsented persistence and subsequent execution of an embedded native payload.

Import-time WSL-to-Windows Startup persistence via dropped PE executable.

The normal ESM entry contains an obfuscated bootstrap and an embedded PE binary. On import in a qualifying Linux/WSL environment, it enumerates Windows user profiles, identifies one via AppData and NTUSER.DAT, creates that user's Startup directory if needed, and writes vite-native-helper.exe. This establishes execution at the next Windows logon without user consent.

Despite no npm lifecycle hook, the default import path performs concealed, import-time cross-platform startup persistence by dropping a native executable. This is concrete malicious behavior unrelated to calendar-day utilities.