Importing the main entrypoint can silently drop an embedded Windows PE into a user's Startup folder when running non-production Node on Linux with a mounted Windows drive. This establishes persistence outside the package's documented functionality.
Static reason
No blocking static signals were detected.
Trigger
Import of index.mjs in a qualifying Linux/WSL development runtime.
Impact
A native executable is persisted for execution at Windows user login.
Mechanism
Obfuscated embedded-PE dropper with Windows Startup persistence.
Attack narrative
At import time, index.mjs conditionally detects WSL-style /mnt/c, enumerates Windows users, checks AppData and NTUSER.DAT, creates that user's Startup directory, and writes a hex-embedded MZ/PE as vite-native-helper.exe. The payload is concealed behind hex decoding and errors are suppressed.
Rationale
The package's calendar utilities do not justify an import-time hidden executable drop into the Windows Startup folder. This is concrete persistence behavior despite having no npm lifecycle hook.
Evidence
index.mjspackage.jsonstore.mjs/mnt/c/Users/<detected-user>/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe