GCVE-110-OSM-2026-8910

The package disguises itself as a benign calendar/streak utility but contains a self-executing async IIFE in `index.mjs` that targets WSL environments (checks for Linux platform + `/mnt/c` existence), enumerates Windows user profiles via the WSL-mounted filesystem, and drops a fetched binary named `vite-native-helper.exe` into the Windows Startup folder (`AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup`) for persistence. The payload is downloaded from a Backblaze B2 bucket (`https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat`) with the URL deliberately split across template literal fragments (`p`, `h`, `b`, `f`) to evade static detection. The attacker model is a WSL-targeting persistence implant delivered via npm supply chain: enumerate user, establish boot persistence, execute attacker-controlled PE binary. The legitimate-looking calendar math above the IIFE is pure cover. DESTINATION - reconstructed: https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat (primary, reconstructed) in index.mjs - custom-c2: f004.backblazeb2.com (reconstructed) in index.mjs EXFIL - System Information Collection in index.mjs: "process.platform" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in index.mjs: "https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat" PAYLOAD FILES index.mjs INDICATORS (IOCs) - payloadFileHash: 4ad0170829c63aa49a58a2e8b38ad0cdaeadaa7e646d69a8b0651c51fa0d63eb