registry / streak-calendar-core / 1.0.0

streak-calendar-core@1.0.0

Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for svelte-daily-streaks.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Importing the main entry on a targeted WSL development machine fetches and unpacks a remote executable, then writes a Windows Startup launcher for persistence. This is unrelated to calendar/streak functionality.

Static reason

No blocking static signals were detected.

Trigger

Import of index.mjs with NODE_ENV other than production on Linux with WSL_DISTRO_NAME set.

Impact

A remote executable is configured to run at Windows user login.

Mechanism

Obfuscated remote payload download, extraction, and Windows Startup persistence.

Attack narrative

The main module contains an obfuscated, import-time payload gated for WSL development systems. It dynamically imports filesystem, process, and HTTPS modules; downloads a tarball from Backblaze; extracts it; and writes a Startup batch file that launches the extracted RenameMe.exe on login. The behavior is concealed among legitimate calendar utilities and is not needed for the package purpose.

Rationale

The package establishes stealthy remote payload delivery and login persistence during ordinary import. Absence of an npm lifecycle hook does not mitigate this concrete runtime attack path.

Evidence

package.jsonindex.mjsstore.mjs/mnt/c/Users/<USER>/AppData/Local/Microsoft/Windows/syscache/dep-cache.tar.gz/mnt/c/Users/<USER>/AppData/Local/Microsoft/Windows/syscache/helper/RenameMe.exe/mnt/c/Users/<USER>/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/env-setup.cmd

Network endpoints

streak-calendar-core@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code