MAL-2026-12468

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (6ba4f1a9b23ca375fed98868d8ca488ec722b473060834412b0b1b23f5cae37a) streak-math-kit@1.0.0 is advertised as a math primitives library but its index.mjs top-level IIFE _bootstrap() runs on any import and drops a hex-embedded Windows PE named vite-native-helper.exe onto the host. Execution is gated by platform==='linux' && NODE_ENV!=='production' to target WSL developer environments. The code enumerates /mnt/c/Users/* to locate a Windows user profile (identified by the presence of AppData and NTUSER.DAT), then hex-decodes an approximately 500KB embedded binary with an MZ/PE header and writes it to that user's AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup directory, where Windows auto-executes it on the next logon. Path segments (AppData, Roaming, Startup subpath, NTUSER.DAT, the filename vite-native-helper.exe) are stored as hex-encoded string arrays and reassembled at runtime via Buffer.from(h,'hex') to hide the Windows-targeting behavior from casual source review. Source comments state the module has no network or filesystem side effects, contradicting the observed behavior. Result: any developer who imports this package from a WSL shell gains a persistent Windows executable that runs at every subsequent Windows logon.