streak-daykit@1.0.0

No blocking static signals were detected.

Runtime import of streak-daykit under Node on Linux with /mnt/c available and NODE_ENV not production.

Remote code is persisted to execute when the targeted Windows user logs in.

WSL profile discovery, remote EXE download, and Windows Startup persistence

The package's default import silently invokes an async bootstrap. On Linux WSL it identifies a Windows profile, creates that user's Startup directory path, downloads an opaque payload from Backblaze B2, and saves it as vite-native-helper.exe. Startup placement establishes persistence outside the package's documented streak-calculation purpose.

The import-time hidden download and placement of a remote executable in a Windows Startup folder is concrete persistence behavior. Absence of an npm lifecycle hook does not mitigate runtime import execution.