OSV ID
MAL-2026-11140
Ecosystem
npm
Summary
On import, a top-level async IIFE in index.mjs gates on process.platform === 'linux' and NODE_ENV!== 'production', checks for a WSL host mount at /mnt/c, locates the Windows user profile, fetches an opaque binary from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat, and writes it to the Windows Startup folder as %APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe so that the binary executes on the next Windows login. The URL host, bucket, filename, and dropped executable name are assembled from single-letter variables and template literals rather than appearing as string literals, and the dropped file uses a vite-adjacent name to blend in with legitimate tooling. The fetched payload is not pinned, not verified, and unrelated to any documented package purpose.
Source: amazon-inspector (065729796ad9ceb2c9939587ce1f61b78bdf36fc13807ace7e2383c22f5e61ba)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.