streak-daily-lib@1.0.0

Analysis

Package streak-daily-lib@1.0.0 is a trojanized package that disguises itself as a calendar-day streak-math library. On import, it runs a hidden payload that targets Windows Subsystem for Linux (WSL) environments. The payload downloads two files from a Backblaze B2 bucket (f004[.]backblazeb2[.]com): a tarball (helper.tar.gz) containing a binary (helper/vite.exe), and a second binary (background-service). It extracts the tarball, spawns the background-service binary as a detached background process, and writes a .cmd launcher script (env-setup.cmd) to the Windows Startup folder at C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ that launches helper/vite.exe silently on every boot. The package has no lifecycle hooks — the payload executes on module import via setImmediate.