The quorvex npm package versions 0.2.0 and 0.2.1 include a main module (index.mjs) that contains a base64-encoded Windows PE binary embedded as a constant. When imported on Windows systems with over 4GB of RAM, the code decodes and writes this binary to the Startup folder (%APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe), causing it to execute automatically at the next user logon. The package employs a memory size check as a sandbox evasion technique and uses naming related to 'vite' to disguise the malicious payload. The README misleads users by claiming the package is a placeholder with no functionality, while the code is designed to run at import time and evade static analysis.

Installing or importing the quorvex package on a Windows host with more than 4GB of RAM results in the silent installation of an attacker-controlled executable that gains persistence by auto-executing at user logon. This can lead to unauthorized code execution and potential compromise of the affected system. The persistence mechanism leverages the Windows Startup folder, making the threat persistent across reboots.

No official patch or remediation is currently documented for this malicious package. Users and administrators should avoid installing or importing the quorvex package versions 0.2.0 and 0.2.1. Remove any instances of the 'vite-native-helper.exe' file from the Startup folder if present. Employ npm package reputation checks and use trusted sources to prevent installation of malicious packages. Monitor for and block suspicious executables in user Startup folders on Windows systems.