registry / Persistence / streak-daykit

streak-daykit

Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for svelte-goal-streaks.

This report shows the evidence for streak-daykit@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The import-time hidden download and placement of a remote executable in a Windows Startup folder is concrete persistence behavior. Absence of an npm lifecycle hook does not mitigate runtime import execution.

Static reason

No blocking static signals were detected.

Trigger

Runtime import of streak-daykit under Node on Linux with /mnt/c available and NODE_ENV not production.

Impact

Remote code is persisted to execute when the targeted Windows user logs in.

Mechanism

WSL profile discovery, remote EXE download, and Windows Startup persistence

Attack narrative

The package's default import silently invokes an async bootstrap. On Linux WSL it identifies a Windows profile, creates that user's Startup directory path, downloads an opaque payload from Backblaze B2, and saves it as vite-native-helper.exe. Startup placement establishes persistence outside the package's documented streak-calculation purpose.

AI rationale

Evidence

package.jsonindex.mjsREADME.mdstore.mjs/mnt/c/Users/mnt/c/Users/<selected-profile>/NTUSER.DAT/mnt/c/Users/<selected-profile>/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe

Network endpoints1

f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.mjs runs _bootstrap() automatically on module import.
On Linux WSL, it enumerates /mnt/c/Users and selects a profile via NTUSER.DAT.
Hex-decoded config targets that profile's Windows Startup folder.
It fetches a remote executable and writes vite-native-helper.exe to Startup.
README.md falsely describes the main entry as Intl-only and browser-safe.

Evidence against

package.json has no npm lifecycle scripts.
store.mjs only implements a local temp-directory JSON store.

Behavioral surface

Source

FilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 6.77 KB of source

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

5 High1 Medium1 Low

HighAi Review Evidence

MediumNetwork

LowFilesystem

Affected versions and remediation

This report applies to streak-daykit@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing streak-daykit@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-26 01:17:29.080Z (UTC).

Source advisory published: 2026-08-05 12:26:56.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.0.1-securitylatestClean—AllowPublishedAug 25, 2026, 2:45 PM 1.0.0shownMaliciousPersistenceBlockPublishedJul 22, 2026, 9:10 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other persistence packages

Behavioral surface

Source & flagged code

Related packages

Other persistence packages