The caldora npm package version 1.0.0 runs a top-level asynchronous routine on import that, under specific conditions (Linux with /mnt/c present indicating WSL, and NODE_ENV not 'production'), constructs a URL from split strings to download a binary file named 'vite-native-helper.exe' from a third-party host (f004.backblazeb2.com). This binary is then written into the Windows Startup folder of the host user, ensuring it runs automatically on the next Windows login. This behavior establishes persistent code execution on the Windows host originating from a WSL-based install. The obfuscation and environment checks are designed to evade detection on typical developer machines and continuous integration systems. The malicious executable masquerades as a legitimate vite helper, although the package does not require any native helper, confirming the malicious nature of the payload.

This malicious package enables persistent unauthorized code execution on Windows hosts via WSL by dropping and executing a binary at user login. This persistence mechanism can allow attackers to maintain foothold on affected systems, potentially leading to further compromise. The payload is specifically targeted to WSL environments with non-production NODE_ENV settings, reducing detection likelihood in standard environments.

No official patch or remediation is currently documented. Users should avoid installing or using caldora version 1.0.0. If already installed in a WSL environment, users should check for and remove the 'vite-native-helper.exe' file from the Windows Startup folder to prevent persistent execution. Monitor for suspicious activity related to this executable. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.