registry / Persistence / streak-calendar-core

streak-calendar-core

Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for svelte-daily-streaks.

This report shows the evidence for streak-calendar-core@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The package establishes stealthy remote payload delivery and login persistence during ordinary import. Absence of an npm lifecycle hook does not mitigate this concrete runtime attack path.

Static reason

No blocking static signals were detected.

Trigger

Import of index.mjs with NODE_ENV other than production on Linux with WSL_DISTRO_NAME set.

Impact

A remote executable is configured to run at Windows user login.

Mechanism

Obfuscated remote payload download, extraction, and Windows Startup persistence.

Attack narrative

The main module contains an obfuscated, import-time payload gated for WSL development systems. It dynamically imports filesystem, process, and HTTPS modules; downloads a tarball from Backblaze; extracts it; and writes a Startup batch file that launches the extracted RenameMe.exe on login. The behavior is concealed among legitimate calendar utilities and is not needed for the package purpose.

AI rationale

The package establishes stealthy remote payload delivery and login persistence during ordinary import. Absence of an npm lifecycle hook does not mitigate this concrete runtime attack path.

Evidence

package.jsonindex.mjsstore.mjs/mnt/c/Users/<USER>/AppData/Local/Microsoft/Windows/syscache/dep-cache.tar.gz/mnt/c/Users/<USER>/AppData/Local/Microsoft/Windows/syscache/helper/RenameMe.exe/mnt/c/Users/<USER>/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/env-setup.cmd

Network endpoints1

f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.mjs decodes node fs/path/child_process/https modules.
Import-time _sync targets Linux-on-WSL non-production environments.
Downloads https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz.
Writes archive, spawns tar, and installs a Startup .cmd launcher.
Persistence targets RenameMe.exe in Windows user paths.

Evidence against

package.json has no lifecycle scripts.
store.mjs is a separate temp-directory JSON store with no network use.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 8.24 KB of source

Source & flagged code

1 flagged

index.mjsView file

163L164: const [_fs, _pa, _cp, _hs] = await Promise.all(_mods.map(m => import(_decode(m)))); L165: const { cache, init } = _resolveLocations(_pa, proc);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.mjsView on unpkg · L163

Source & flagged code

1 flagged · loading source

index.mjsView file

163L164: const [_fs, _pa, _cp, _hs] = await Promise.all(_mods.map(m => import(_decode(m)))); L165: const { cache, init } = _resolveLocations(_pa, proc);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.mjsView on unpkg · L163

Findings

2 Medium1 Low

MediumDynamic Requireindex.mjs

MediumEnvironment Vars

LowFilesystem

Affected versions and remediation

This report applies to streak-calendar-core@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing streak-calendar-core@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-26 01:12:24.266Z (UTC).

Source advisory published: 2026-08-05 12:33:17.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.0.1-securitylatestClean—AllowPublishedAug 25, 2026, 2:37 PM 1.0.0shownMaliciousPersistenceBlockPublishedJul 23, 2026, 2:11 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other persistence packages

Behavioral surface

Related packages

Other persistence packages

Source & flagged code