lib-streak-math @1.0.0

Summary

The package's main entry index.mjs presents itself as a math helper but contains a top-level async IIFE that runs on any require / import of the module. All network destinations, filesystem paths, subprocess names, and Node built-in module names are stored as integer arrays and reconstructed at runtime via a char-code decoder _D(a) = String.fromCharCode(...a.map((c,i)=>((c-_K[i%3])+256)%256)) with _K=[11,23,47] , hiding fs/promises , path , child_process , and node-fetch from static inspection. Decoded, the block downloads https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz into a hidden directory under AppData/Local/Microsoft/Windows/syscache/helper/ , extracts it with tar -xzf , and executes the dropped payload. On Windows, the target user profile is located by scanning /mnt/c/Users (WSL), and a launcher env-setup.cmd is written into AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/ so the dropped vite.exe auto-launches on every login. On Linux, a background-service binary is written to the same hidden path, chmod 0o755 d, and spawned with stdio: 'ignore', detached: true followed by .unref() , surviving the parent process. The package's advertised math-library purpose is unrelated to the code that actually runs on import.

Source: amazon-inspector (06cd4f53bed50a86ce85bcd8ebcd672ae7e3c01926cac1efd7f3dcf152484267)