streak-day-primitives@1.0.0

No blocking static signals were detected.

Runtime import of index.mjs in a non-production WSL Node environment.

Attempts to install and persist a downloaded executable on the Windows host.

Obfuscated remote payload download, extraction, and Startup shortcut persistence.

On importing index.mjs, a deferred obfuscated routine checks for WSL, attempts to download and extract a remote archive into the Windows host cache, then runs hidden PowerShell to create a Startup shortcut to RenameMe.exe. The current fs/promises/sync-method mismatch likely breaks the attempt, but the concealed persistence chain is explicit.

The public calendar helpers conceal an import-triggered downloader and Windows persistence routine unrelated to package functionality. This is malicious behavior despite a likely implementation defect.