If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (9127b24fd8619b810163b5b5714d580951a3a96cfa1b37e63a57ff3cc9c2cca5)
quorvex@0.2.1 ships index.mjs as the package main, containing a base64-encoded Windows PE (~355KB) in a PAYLOAD constant. At import time on Windows hosts with more than 4GB of RAM, the code decodes the payload and writes it to %APPDATA%/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe, causing Windows to auto-execute the dropped binary at the next user logon. The README self-describes the package as a placeholder with 'nothing in here yet' while documenting deliberate anti-tree-shaking design ('index.mjs performs a real import-time assignment... that no bundler can prove is inert') to ensure the drop runs when the module is loaded. The vite-native-helper.exe filename and Vite-adjacent naming are a cover story; the memory-size gate is a sandbox-evasion check. Installing or importing this package on a Windows host results in an opaque attacker-controlled binary being placed in the user's Startup folder with logon-time persistence.