OSV ID
MAL-2026-11010
Ecosystem
npm
Summary
index.mjs auto-invokes a _sync() routine at module import. Under Linux with NODE_ENV!= production and access to a WSL /mnt/c mount, it locates a Windows user profile, fetches an opaque binary from a Backblaze B2 bucket (host, bucket id, and filename are split across four variables to hide the URL: https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat), and writes it as vite-native-helper.exe into the user's Windows Startup folder (AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup) for execution at next logon. The payload uses cover-story naming (vite-dep.dat, vite-native-helper.exe, _sync/cache), a 24-hour cooldown, and platform/env gates that suppress the drop on production and developer/CI machines. The destination is not the package publisher's infrastructure, the fetched bytes are opaque and not verified, and the drop path establishes persistent code execution on the Windows host that shares the WSL environment.
Source: amazon-inspector (3bc3f7e9ef1bbc85d0303406eac1b28cace865d65ab2bbad1104ba2f0adaaa78)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.