The [email protected] npm package, advertised as a small dependency-free calendar/day-math helper, contains a large main entry file (~521 KB) with embedded malicious Windows PE payload and dropper logic. The module includes hex-encoded strings that decode to the Windows Startup folder path, a filename (vite-native-helper.exe), and a Windows executable binary. When the package is imported or required on a Windows system, it reconstructs and writes this executable into the user's Startup folder, causing it to run automatically on subsequent logons. The code is deliberately obfuscated with hex encoding and includes misleading comments and filenames to evade detection.

On Windows systems, simply importing or requiring this package results in the installation of a persistent executable that runs at every user logon without user consent. This can lead to unauthorized code execution and persistence on affected machines. The package does not appear to perform network or filesystem operations beyond writing the executable to the Startup folder, but the presence of a persistent dropper poses a significant security risk.

No official patch or remediation is currently documented. Users and organizations should avoid using [email protected]. Remove the package from projects and delete the vite-native-helper.exe file from the Startup folder if present. Monitor for any unexpected executables in user Startup folders. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.