Importing the main entry on WSL in a non-production environment triggers a hidden payload chain. It downloads and persists an executable in the Windows user Startup folder.
Static reason
No blocking static signals were detected.
Trigger
Importing index.mjs under WSL with NODE_ENV not production
Impact
Unconsented executable launch and persistence on the Windows host
Mechanism
Obfuscated remote payload download, extraction, and Startup persistence
Attack narrative
On module import, index.mjs conditionally detects WSL, downloads an obfuscated helper archive from Backblaze B2, writes and extracts it under the mounted Windows AppData tree, then creates a .cmd file in the user Startup directory that launches the extracted RenameMe.exe. This is hidden behind misleading cache-resolver comments and executes without an explicit user command.
Rationale
The hidden import-time download, executable extraction, and Startup-folder persistence are concrete malware behavior unrelated to streak math. No lifecycle hook is needed because the payload activates when the exported module is imported.
Evidence
package.jsonindex.mjsstore.mjs
Network endpoints1
f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz