streak-day-primitives@1.0.0

Summary

The package advertises itself as dependency-free calendar-day arithmetic, but index.mjs contains top-level code that runs on import. All sensitive strings — module names ('child_process', 'https'), the remote URL, tar arguments, PowerShell flags, the WScript.Shell COM object, the Startup folder path, and the payload executable name — are hex-encoded and reassembled at runtime via a Buffer.from(s,'hex').toString() helper (_d + _k table) to hide the payload from static review. When the host is Linux with WSL_DISTRO_NAME set and /mnt/c is reachable, the code fetches a tarball from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz, extracts it into the Windows user's AppData tree, and uses PowerShell (-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass) plus WScript.Shell CreateShortcut to drop a.lnk pointing at the extracted RenameMe.exe into the Windows user's Startup folder. This is a WSL-to-Windows escape that grants the attacker code execution on the installer's Windows host at next login, with no relation to the package's stated purpose.

Source: amazon-inspector (2c4f0cfff000aa550229c0148bf96c70335e4d37048fa9f8fda3d4391ea2249b)