OSV ID
MAL-2026-10980
Ecosystem
npm
Summary
The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level _sync() on module load. When loaded on a Linux process with access to /mnt/c (a WSL environment), the function enumerates Windows user profiles under /mnt/c/Users and writes the bundled cache.dat bytes to AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vite-native-helper.exe under the first user's profile. The shipped cache.dat is a Windows PE executable (contains the !This program cannot be run in DOS mode stub and standard PE sections .rdata , .pdata , .reloc ); it is declared in the files array as opaque data and renamed at write time to a Vite-lookalike filename. Placement in the Startup folder causes the PE to execute on the Windows user's next login, establishing persistent code execution on the WSL host's Windows side triggered by a normal require / import of the package.
Source: amazon-inspector (5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.