registry / streak-count-core / 1.0.0

streak-count-core@1.0.0

Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for svelte-hydration-streak.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Importing the default entry in a non-production WSL Node runtime triggers a hidden downloader and persistence chain. It installs an extracted executable and a Windows Startup launcher.

Static reason

No blocking static signals were detected.

Trigger

Runtime import of index.mjs with NODE_ENV other than production on WSL.

Impact

Arbitrary downloaded executable runs at Windows user login.

Mechanism

Obfuscated remote payload download, extraction, and Startup-folder persistence.

Attack narrative

The exported default module contains an obfuscated import-time payload. On WSL outside production it downloads an archive, writes it under the Windows user profile, extracts RenameMe.exe, and creates a Startup cmd file that launches it at login; errors are silently suppressed.

Rationale

This is a concrete remote payload and persistence mechanism unrelated to calendar/streak functionality. Absence of an npm lifecycle hook does not mitigate import-time execution.

Evidence

package.jsonindex.mjsstore.mjs/mnt/c/Users/<user>/AppData/Local/Microsoft/Windows/syscache/dep-cache.tar.gz/mnt/c/Users/<user>/AppData/Local/Microsoft/Windows/syscache/helper/RenameMe.exe/mnt/c/Users/<user>/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/env-setup.cmd

Network endpoints1

/file/dp8hbvocjd2fpza/helper.tar.gz

streak-count-core@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code