kordyn@0.9.11

One or more suspicious static signals were detected.

Importing kordyn on Linux/WSL with >4GB RAM and /mnt/c mounted.

Unconsented persistent execution of an opaque native payload.

Guarded import-time Windows Startup persistence via dropped PE payload.

On module import, index.mjs decodes its embedded payload. On a targeted Linux/WSL system it waits briefly, discovers a Windows user through /mnt/c/Users, creates that user's Startup folder, and writes vite-native-service.exe there if absent. This establishes execution at the next Windows login without user consent.

The package description promises simple utilities, but its sole implementation is a concealed native payload dropper with Startup-folder persistence. The absence of lifecycle hooks does not mitigate import-time malicious behavior.