The [email protected] npm package masquerades as a math primitives library but executes a top-level function on import that targets WSL environments. It enumerates Windows user directories under /mnt/c/Users/* to find profiles containing AppData and NTUSER.DAT. It then hex-decodes an embedded Windows PE executable (~500KB) and writes it to the user's AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup directory as vite-native-helper.exe. This executable runs automatically on every subsequent Windows logon, establishing persistence. The code obfuscates its Windows-targeting behavior by storing critical path strings and the executable as hex-encoded arrays, reassembled at runtime. The package's source comments falsely claim no network or filesystem side effects, contradicting the actual malicious behavior.

Any developer importing [email protected] in a WSL environment will have a persistent Windows executable planted in their startup folder, which executes on every Windows logon. This could allow unauthorized code execution on the Windows host, potentially leading to system compromise or further malicious activity. The persistence mechanism is stealthy due to obfuscation and targeting only WSL environments, increasing the risk of unnoticed infection.

No official patch or remediation is currently documented. Users should avoid using [email protected] entirely. Remove the vite-native-helper.exe executable from the Windows startup directory if present. Monitor WSL environments for unexpected package imports and audit startup folders for unauthorized executables. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.