streak-key-lib@1.0.0

One or more suspicious static signals were detected.

Runtime import of streak-key-lib's default entrypoint.

Remote code execution, local data exposure, and persistence in the importing user's environment.

Obfuscated import-time downloader, filesystem scanner, detached payload executor, and persistence writer.

The default export entry begins as calendar utilities but embeds a large obfuscated routine that runs on module import. Its decoded operations obtain environment-selected paths, dynamically load Node APIs, fetch remote payloads, write/chmod and detached-spawn them, inspect filesystem entries, and write a platform-specific persistence command. These actions are unrelated to streak math or the optional store.

Concrete import-time remote payload execution and persistence behavior is present in the package's default entrypoint. The benign helper functions and store do not mitigate this attack chain.