MAL-2026-12344 Malicious code in caldora (npm)

[email protected] runs a top-level async routine in index.mjs on import. When executed on Linux with /mnt/c present (WSL) and NODE_ENV!= 'production', it assembles the URL https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat from four split string constants, fetches the opaque binary, and writes it as 'vite-native-helper.exe' into the host Windows user's Startup folder (AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup). The dropped executable will run automatically at the next Windows login, establishing persistent code execution on the Windows host from a WSL-based install. The URL is split into a='https', b='f004.backblazeb2.com', c='dp8hbvocjd2fpza', d='vite-dep.dat' to defeat naive string scanning; the WSL/non-production gate keeps the payload dormant on typical developer machines and CI while targeting WSL developer hosts. The filename masquerades as a vite helper, but the package's declared purpose and content do not require any native helper, and the destination is a third-party file host unrelated to any legitimate publisher.