GCVE-110-OSM-2026-8918

The package is a supply-chain attack targeting developers running WSL (Windows Subsystem for Linux). The `_sync` function at the bottom of index.mjs — deliberately separated from the legitimate calendar-math library code above it — detects a WSL environment via `process.platform === 'linux'` and the presence of `/mnt/c`, enumerates Windows user profiles by scanning for `NTUSER.DAT`, then copies a bundled file `cache.dat` from the package directory into the Windows Startup folder (`AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup`) renamed as `vite-native-helper.exe`. This is a textbook persistence dropper: `cache.dat` is the malicious payload, the startup folder write guarantees execution on every Windows login, and the disguise name (`vite-native-helper.exe`) borrows legitimacy from the Vite build tool. The `NODE_ENV === 'production'` guard ensures the payload only fires on developer machines. The surrounding library code is plausible enough to avoid immediate suspicion. ENTRY index.mjs (main: index.mjs) EXFIL - System Information Collection in index.mjs: "process.platform" PAYLOAD FILES index.mjs INDICATORS (IOCs) - payloadFileHash: 51fb2e081b838826d250b3227b2e310b13aa8506778307681ab6afbc1ef93c18