MAL-2026-14224 Malicious code in streak-metric-test (npm)

[email protected] ships a fully wired dropper that fires on import/require of the package root. The top-level async IIFE in dist/index.mjs assembles a Buffer from a base64 string array, writes it to ~/.cache/streak-metric/h, chmods it 0o755, and detach-spawns it via child_process.spawn(..., { detached: true, stdio: 'ignore' }).unref(). The supporting primitives (ensureDir, writeBinary, runDetached) live in dist/internal/daymath.mjs alongside unrelated day-math helpers, with docstrings ("Start a background task", "Save data to cache") that mislabel the chmod-executable + detached-spawn behavior as benign caching. The payload array is currently [""] (inert), but the decode→write→chmod+x→detached-spawn chain is complete and only requires populating one string to arm; the package name suffix -test, the cover-story comments, and the hidden cache path are consistent with a staging artifact rather than legitimate functionality. No native addon, no declared purpose that would justify writing and executing an opaque binary from an in-source blob at import.