MAL-2026-11140

    Dashboard / Malicious Package / MAL-2026-11140

    MAL-2026-11140

    Published: 28 Jul 2026Last Modified: 28 Jul 2026

    Summary: Malicious code in korvica (npm)

    Details: Source: amazon-inspector (065729796ad9ceb2c9939587ce1f61b78bdf36fc13807ace7e2383c22f5e61ba) On import, a top-level async IIFE in index.mjs gates on process.platform === 'linux' and NODE_ENV!== 'production', checks for a WSL host mount at /mnt/c, locates the Windows user profile, fetches an opaque binary from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat, and writes it to the Windows Startup folder as %APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe so that the binary executes on the next Windows login. The URL host, bucket, filename, and dropped executable name are assembled from single-letter variables and template literals rather than appearing as string literals, and the dropped file uses a vite-adjacent name to blend in with legitimate tooling. The fetched payload is not pinned, not verified, and unrelated to any documented package purpose.

    References: https://www.npmjs.com/package/korvica/v/1.0.0

    Affected packages

    Package

    Name: korvica

    Purl: pkg:npm/korvica

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-11140 | CVE-DB