Importing the main module on a non-production Linux/WSL host can install a downloaded executable into a Windows user's Startup folder. This establishes persistence without user consent.
Static reason
No blocking static signals were detected.
Trigger
Import of korvica on Linux/WSL with NODE_ENV not set to production.
Impact
A remote payload can execute automatically at Windows user login.
Mechanism
Remote executable download and Windows Startup persistence
Attack narrative
At module import, index.mjs checks for a WSL-mounted Windows installation, locates a user profile, downloads vite-dep.dat from Backblaze, and saves it as vite-native-helper.exe in that profile's Startup folder. The executable will run at the next Windows login; failures are suppressed.
Rationale
The package contains a concealed import-time remote payload delivery and persistence chain unrelated to calendar utilities. This is concrete malware behavior.
Evidence
package.jsonindex.mjsstore.mjs
Network endpoints1
f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat