MAL-2026-14223 Malicious code in streak-key-lib (npm)

index.mjs advertises itself as a dependency-free, browser-safe day-math helper that 'touches no network and no filesystem,' but the file body contains a ~65KB obfuscator.io-style block (base64 string array plus an RC4/XOR decoder function A(L,q), with self-defense regexes designed to break under beautification/debugging) sitting at module top level directly above the small plain math exports. There are no lifecycle scripts; the payload executes on any require/import of the package. The header comment steers consumers to install a companion package (svelte-insight-hydration / svelte-insight-tracker) rather than this one directly, framing streak-key-lib as an internal helper meant to arrive transitively — a lure pattern that places hidden import-time code into parent applications' Node processes. The file header name (streak-larq-hydration) does not match the package name, indicating a rename from a template. The mismatch between the stated purpose (pure math, no I/O) and the shipped contents (large encrypted top-level blob with an RC4 string decoder) is the standard shape of a supply-chain stager: benign-looking surface code alongside hidden import-time execution of decoded strings.