registry / Persistence / streak-count-core

streak-count-core

Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for svelte-hydration-streak.

This report shows the evidence for streak-count-core@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is a concrete remote payload and persistence mechanism unrelated to calendar/streak functionality. Absence of an npm lifecycle hook does not mitigate import-time execution.

Static reason

No blocking static signals were detected.

Trigger

Runtime import of index.mjs with NODE_ENV other than production on WSL.

Impact

Arbitrary downloaded executable runs at Windows user login.

Mechanism

Obfuscated remote payload download, extraction, and Startup-folder persistence.

Attack narrative

The exported default module contains an obfuscated import-time payload. On WSL outside production it downloads an archive, writes it under the Windows user profile, extracts RenameMe.exe, and creates a Startup cmd file that launches it at login; errors are silently suppressed.

AI rationale

This is a concrete remote payload and persistence mechanism unrelated to calendar/streak functionality. Absence of an npm lifecycle hook does not mitigate import-time execution.

Evidence

package.jsonindex.mjsstore.mjs/mnt/c/Users/<user>/AppData/Local/Microsoft/Windows/syscache/dep-cache.tar.gz/mnt/c/Users/<user>/AppData/Local/Microsoft/Windows/syscache/helper/RenameMe.exe/mnt/c/Users/<user>/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/env-setup.cmd

Network endpoints1

c004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.mjs:88-97 hex-obfuscates Node modules, paths, URL, and payload names.
index.mjs:138-152 targets Linux WSL and derives Windows user paths.
index.mjs:155-171 downloads an archive from c004.backblazeb2.com.
index.mjs:174-186 extracts an EXE and writes a Windows Startup .cmd launcher.
index.mjs:189-211 runs this chain automatically on import outside production.

Evidence against

package.json has no npm lifecycle scripts.
store.mjs only implements a separate temp-directory JSON store.

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 9.07 KB of source

Source & flagged code

1 flagged

index.mjsView file

193L194: const [_fs, _pa, _cp, _hs] = await Promise.all(_cfg.m.map(m => import(_h(m)))); L195: const { base, start } = _resolvePaths(_pa, proc);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.mjsView on unpkg · L193

Source & flagged code

1 flagged · loading source

index.mjsView file

193L194: const [_fs, _pa, _cp, _hs] = await Promise.all(_cfg.m.map(m => import(_h(m)))); L195: const { base, start } = _resolvePaths(_pa, proc);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.mjsView on unpkg · L193

Findings

2 Medium1 Low

MediumDynamic Requireindex.mjs

MediumEnvironment Vars

LowFilesystem

Affected versions and remediation

This report applies to streak-count-core@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing streak-count-core@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-26 01:12:24.022Z (UTC).

Source advisory published: 2026-08-05 12:22:50.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.0.1-securitylatestClean—AllowPublishedAug 25, 2026, 2:42 PM 1.0.0shownMaliciousPersistenceBlockPublishedJul 23, 2026, 1:49 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other persistence packages

Behavioral surface

Source & flagged code

Related packages

Other persistence packages