MAL-2026-11140
Malicious code in korvica (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (065729796ad9ceb2c9939587ce1f61b78bdf36fc13807ace7e2383c22f5e61ba) On import, a top-level async IIFE in index.mjs gates on process.platform === 'linux' and NODE_ENV!== 'production', checks for a WSL host mount at /mnt/c, locates the Windows user profile, fetches an opaque binary from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat, and writes it to the Windows Startup folder as %APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe so that the binary executes on the next Windows login. The URL host, bucket, filename, and dropped executable name are assembled from single-letter variables and template literals rather than appearing as string literals, and the dropped file uses a vite-adjacent name to blend in with legitimate tooling. The fetched payload is not pinned, not verified, and unrelated to any documented package purpose.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for korvica (npm). Pin to a known-safe version or switch to an alternative.