kordyn@0.9.14

One or more suspicious static signals were detected.

A consumer imports kordyn on Linux/WSL with more than 4 GiB RAM and a mounted Windows drive.

Arbitrary embedded executable runs at subsequent Windows user logon.

Decodes embedded PE payload and writes it to Windows Startup persistence.

The public ESM entrypoint executes on import. It decodes a large Base64 value containing an MZ/PE executable, then after a randomized delay detects WSL and writes vite-native-helper.exe into the first discovered Windows user's Startup directory. The dropped program will execute on a later Windows logon, providing unconsented persistence.

This is concrete stealthy persistence via an import-time payload drop, unrelated to the documented placeholder utilities. The absence of an install hook does not mitigate the malicious runtime behavior.