streak-bucket-lib @1.0.0

Summary

The package advertises pure calendar/streak math but its main entry (index.mjs) schedules an async routine on module import via Promise.resolve().then(setTimeout(_i,0)). That routine dynamically imports fs/path/child_process/https using module names decoded from a _k lookup table through a reverse-then-hex unwrapper ( const _d = s => Buffer.from(s.split('').reverse().join(''), 'hex').toString() ), HTTP-GETs a remote archive to a hardcoded URL reconstructed from the same table, writes the response bytes to a per-user Windows AppData path, spawns an extractor on the archive, then invokes powershell with a script that constructs a WScript.Shell.lnk shortcut (TargetPath/WorkingDirectory/Save) in the user's Startup folder for persistence across reboots. Every operational string — module names, URL, AppData subpath components, extractor argv, and the powershell payload — is stored obfuscated in _k and only decoded at runtime. The behavior fires on any import 'streak-bucket-lib' with no lifecycle hook required. The declared calendar-math purpose has no need for network I/O, filesystem writes under AppData, child process execution, or powershell-authored startup shortcuts; the obfuscated destination table and dropper-plus-persistence shape identify this as a Windows stealer scaffold rather than a library.

Source: amazon-inspector (dc1ac54ede0c029cfc28fa42ff5bdbd04ea17ebb610987c50a9108912588a82c)