kordyn@0.9.16

One or more suspicious static signals were detected.

Runtime import of index.mjs on Linux where /mnt/c maps a Windows installation.

Unconsented Windows persistence and execution of an opaque native payload at user login.

WSL profile discovery and Windows Startup executable dropper

The module decodes an embedded PE executable at import time. On Linux/WSL it locates a Windows profile, creates that profile's Startup directory, and writes vite-native-helper.exe, causing the opaque payload to run at future Windows logins.

This is concrete hidden persistence behavior unrelated to the stated utility package and activates merely on import. Absence of an npm lifecycle hook does not mitigate the import-time dropper.