The [email protected] npm package contains malicious functionality that triggers only when running inside Linux on WSL with NODE_ENV not set to 'production'. It reconstructs critical strings from character codes to evade detection and downloads a helper tarball from a third-party Backblaze URL. After extracting the tarball, it spawns a detached background binary process. It then writes a launcher script into the Windows Startup folder via the WSL filesystem mount, ensuring the binary runs on every Windows logon. This cross-environment persistence technique bypasses Windows security scanning by originating from the Linux subsystem. The package does not verify the authenticity of the downloaded content, relying on a mutable third-party host unrelated to the package's declared purpose.

This malicious package establishes persistent, stealthy execution on Windows hosts via WSL by downloading and running unverified binaries. It can evade Windows-side security tools by leveraging the Linux subsystem to write startup scripts. This behavior can lead to unauthorized code execution and persistence on affected systems, potentially enabling further compromise or malicious activity.

No official patch or remediation is currently documented for this malicious package. Users should avoid installing or using [email protected]. Remove the package if already installed and inspect affected systems for the presence of the dropped binaries and startup scripts in the Windows Startup folder. Since the malicious payload is fetched from an external third-party URL, network-level blocking of the Backblaze URL may help prevent payload retrieval. Monitor for suspicious processes spawned from WSL environments. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.