MAL-2026-11148 Malicious code in streak-core-lib (npm)

[email protected] presents itself as a 'day-math primitives' library, but index.mjs (the package main, executed on any require/import) contains an end-of-file async IIFE that decodes a hex-encoded Windows PE binary embedded in the source and writes it to the current user's Startup folder as vite-native-helper.exe (%AppData%/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe). The destination path components and filename are stored as hex-literal arrays joined and Buffer.from(h,'hex')-decoded at runtime to hide the strings from static inspection, and the embedded payload begins with the MZ header 4D5A90 characteristic of a Windows PE executable. Files placed in the Startup folder execute automatically at every user logon, giving the dropped binary persistent code execution on the installer's Windows host. Inline comments in the file falsely assert that the module 'touches no network and no filesystem' and needs 'no npm lifecycle script', which is contradicted by the fs.writeFile call in the same file. The behavior does not match the package's advertised purpose and fires on import without any user interaction beyond installing the package.