The native-hello-plugin version 1.2.0 for Windows-x64 contains a malicious prebuilt binary that executes a PowerShell command to fetch and run a remote script over unencrypted HTTP. This results in arbitrary code execution on the host when the plugin is loaded. The Linux-arm64 version is unaffected. No official patch or remediation guidance is currently provided.