MAL-2026-11141 Malicious code in lib-streak-math (npm)

The package's main entry index.mjs presents itself as a math helper but contains a top-level async IIFE that runs on any require/import of the module. All network destinations, filesystem paths, subprocess names, and Node built-in module names are stored as integer arrays and reconstructed at runtime via a char-code decoder _D(a) = String.fromCharCode(...a.map((c,i)=>((c-_K[i%3])+256)%256)) with _K=[11,23,47], hiding fs/promises, path, child_process, and node-fetch from static inspection. Decoded, the block downloads https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz into a hidden directory under AppData/Local/Microsoft/Windows/syscache/helper/, extracts it with tar -xzf, and executes the dropped payload. On Windows, the target user profile is located by scanning /mnt/c/Users (WSL), and a launcher env-setup.cmd is written into AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/ so the dropped vite.exe auto-launches on every login. On Linux, a background-service binary is written to the same hidden path, chmod 0o755d, and spawned with stdio: 'ignore', detached: true followed by .unref(), surviving the parent process. The package's advertised math-library purpose is unrelated to the code that actually runs on import.