streak-day-engine @1.0.0

Summary

index.mjs runs a hex-obfuscated top-level async IIFE at module import time. Identifiers and payload constants ( process , fetch , child_process , fs/promises , target paths, URL, tar command, VBS template) are stored hex-encoded in a _c table and decoded via Buffer.from(h, 'hex').toString() . On import, the code fetches https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz, writes the archive under the user's AppData directory, extracts it via tar -xzf , and writes a VBS launcher ( vite-native-helper.vbs ) into AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup that uses CreateObject("WScript.Shell").Run p, 0, False to invoke the extracted RenameMe.exe hidden at every user login. Result: attacker-controlled bytes land on the installer's host on import / require of the package, and a login-persistent execution channel is established via the Windows Startup folder.

Source: amazon-inspector (fb1b5dba41de915e2ef23790e3e92b3839b9a52e5196480d12ae8a7a8208cf82)