kordyn@0.9.18

One or more suspicious static signals were detected.

Import index.mjs on Linux with /mnt/c present and NODE_ENV not production.

A payload executes when the targeted Windows user logs in.

base64 PE dropper to Windows Startup persistence

The package exports an empty placeholder API but, at module import, detects WSL-mounted Windows storage, finds a user profile, creates that user's Windows Startup directory, and writes an embedded PE executable there. The Startup location causes the dropped executable to run at Windows login.

This is concrete, unconsented persistence through import-time dropping of an embedded executable, unrelated to the stated package purpose.