GCVE-110-OSM-2026-9205

This package is a supply-chain implant disguised as a calendar/date utility. The legitimate-looking exports (dayKey, addDays, bucketByDay) are cover for a hidden async IIFE at the bottom of index.mjs that runs on import. It targets WSL environments (checks process.platform === 'linux' and /mnt/c existence), locates a real Windows user profile via NTUSER.DAT discovery under /mnt/c/Users, then writes a downloaded binary to the Windows Startup folder as 'vite-native-helper.exe' — establishing persistence on the host Windows system. The payload is fetched from a Backblaze B2 bucket with the URL reconstructed from split string variables to evade static detection. The attacker model is a classic WSL-pivot persistence dropper in the tradition of Contagious Interview-style npm implants: masquerade as a dev-tool helper, silently install a Windows startup executable on the developer's machine. DESTINATION - reconstructed: https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat (primary, reconstructed) in index.mjs - custom-c2: f004.backblazeb2.com (reconstructed) in index.mjs EXFIL - System Information Collection in index.mjs: "process.platform" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in index.mjs PAYLOAD FILES index.mjs INDICATORS (IOCs) - payloadFileHash: c560a362e88cabaeb15c4009afaa0b3b9fa9b1adf1c8dae8c8d2ac97d4505b79