MAL-2026-12345 Malicious code in calendar-streak-core (npm)

[email protected] is advertised as a dependency-free calendar-day and streak math library, but index.mjs embeds a hex-encoded Windows PE executable (MZ header) in a _bin string array together with a hex-encoded destination path that decodes to %AppData%/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe. A _decode helper (Buffer.from(h,'hex').toString()) and a block labeled 'Decode and write embedded payload' execute at top-level module import, dropping the executable into the per-user Startup folder so it runs on every subsequent Windows logon. In-code comments claim the module 'touches no network and no filesystem' while the code performs exactly that. Both the payload bytes and the destination path are stored as split hex fragments joined at runtime to evade string-level inspection, and the shipped module is ~500KB dominated by the encoded PE, which is inconsistent with the advertised calendar-math scope. Any project on Windows that imports (directly or transitively) this package gains persistent execution of the embedded binary at logon.