MAL-2026-12344

Dashboard / Malicious Package / MAL-2026-12344

MAL-2026-12344

Summary: Malicious code in caldora (npm)

Details: Source: amazon-inspector (720ff44cbfe1253ad00e7fa884ee51d3961308d1a0e5c8b5ec7a05cef05b1b4b) [email protected] runs a top-level async routine in index.mjs on import. When executed on Linux with /mnt/c present (WSL) and NODE_ENV!= 'production', it assembles the URL https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat from four split string constants, fetches the opaque binary, and writes it as 'vite-native-helper.exe' into the host Windows user's Startup folder (AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup). The dropped executable will run automatically at the next Windows login, establishing persistent code execution on the Windows host from a WSL-based install. The URL is split into a='https', b='f004.backblazeb2.com', c='dp8hbvocjd2fpza', d='vite-dep.dat' to defeat naive string scanning; the WSL/non-production gate keeps the payload dormant on typical developer machines and CI while targeting WSL developer hosts. The filename masquerades as a vite helper, but the package's declared purpose and content do not require any native helper, and the destination is a third-party file host unrelated to any legitimate publisher.

References: https://www.npmjs.com/package/caldora/v/1.0.0