Importing the package in Node under WSL triggers a delayed payload drop. The payload is a Base64-embedded Windows executable written into the current Windows user's Startup folder, creating persistence.
Static reason
One or more suspicious static signals were detected.
Trigger
Import `kordyn` from a Node process running under WSL.
Impact
Drops and persists an opaque Windows executable that will run at user logon.
Mechanism
Import-time WSL-gated executable dropper with Windows Startup persistence.
Attack narrative
The package's import entrypoint contains a large Base64 blob with a Windows executable header. On Node import under WSL, it waits briefly, discovers a Windows user profile through `/mnt/c/Users`, creates that user's Startup directory, and writes the decoded blob as `vite-native-helper.exe`. This is unconsented import-time executable deployment and persistence.
Rationale
Direct source inspection confirms a hidden executable payload and import-triggered Startup-folder persistence. The absent lifecycle hook does not mitigate the malicious runtime behavior.
Evidence
package.jsonindex.mjs/mnt/c/Users/mnt/c/Users/<first-user>/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe