The quorvex npm package (versions 0.2.0 and 0.2.1) includes a base64-encoded Windows PE binary embedded in its main module (index.mjs). On import, if the host is a Windows system with more than 4GB of RAM, the package decodes this payload and writes it to the Startup folder as vite-native-helper.exe, causing it to execute automatically at the next user logon. The package's README falsely claims it is a placeholder with no functionality, while the code deliberately avoids tree-shaking by bundlers to ensure the payload runs. The memory size check acts as a sandbox evasion technique. This results in silent installation of an attacker-controlled binary with persistence on affected Windows systems.

Installing or importing the quorvex package on a Windows system with more than 4GB RAM results in the silent drop of a malicious executable that gains persistence by auto-running at user logon. This can lead to unauthorized code execution and potential compromise of the affected system. The obfuscation and sandbox evasion increase the difficulty of detection and analysis.

No official patch or remediation is currently documented. Users should avoid installing or importing quorvex versions 0.2.0 and 0.2.1, especially on Windows hosts. Remove any instances of vite-native-helper.exe from the Startup folder if present. Monitor for and block this package in dependency management and supply chain security controls. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.