The [email protected] npm package includes malicious code in its index.mjs file that triggers on module import if NODE_ENV is not 'production'. It detects a WSL environment by checking process.platform and the WSL_DISTRO_NAME environment variable. Upon detection, it downloads a helper.tar.gz archive from a remote URL, extracts it into the Windows user's AppData Local directory via the WSL mount path (/mnt/c/Users/<user>/AppData/Local/Microsoft/Windows/syscache), and writes an env-setup.cmd script into the Windows Start Menu Startup folder. This script causes a RenameMe.exe executable to auto-launch on each Windows login, establishing persistence. The code uses hex-encoded strings decoded at runtime to hide module names, environment keys, paths, URLs, and commands, indicating deliberate obfuscation. The package's intended functionality does not justify this behavior, confirming it as malicious.

This malicious package can lead to unauthorized code execution on Windows hosts running WSL by installing and persistently executing a Windows executable without user consent. This may allow attackers to maintain long-term access, execute arbitrary commands, or deploy further malware on affected systems. The infection vector is via the npm package import in non-production environments, potentially impacting developers or CI systems using WSL.

No official patch or remediation is currently documented. Users should immediately avoid using [email protected] and remove it from their projects. Audit dependencies for this package and any related malicious code. Consider blocking or removing the package from internal registries and notify development teams about the risk. Monitor for any suspicious processes or files created in the Windows Startup folder and user AppData Local paths on WSL hosts. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.