kordyn@0.9.10

One or more suspicious static signals were detected.

Import `kordyn` from a Node process running under WSL.

Drops and persists an opaque Windows executable that will run at user logon.

Import-time WSL-gated executable dropper with Windows Startup persistence.

The package's import entrypoint contains a large Base64 blob with a Windows executable header. On Node import under WSL, it waits briefly, discovers a Windows user profile through `/mnt/c/Users`, creates that user's Startup directory, and writes the decoded blob as `vite-native-helper.exe`. This is unconsented import-time executable deployment and persistence.

Direct source inspection confirms a hidden executable payload and import-triggered Startup-folder persistence. The absent lifecycle hook does not mitigate the malicious runtime behavior.