In-memory execution and detection evasion

WSL is a working bridge, and npm hygiene stops at the container wall

CloudSEK's BRIDGEHEAD report tracks forty npm typosquats whose install script tests for Windows underneath Linux, then pulls a Rust stealer that reads the host's wallets and cookies.