streak-lib-math @1.0.0

Summary

On import, index.mjs executes an obfuscated async IIFE whose sensitive strings (process, fetch, fs/promises, target URL, path segments, payload filename) are stored as hex literals and reassembled at runtime. The code enumerates Windows user profiles reached from WSL via /mnt/c/Users, skipping default accounts (All Users, Default, Public, defaultuser0), fetches https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.dat, and writes the response bytes as vite-native-helper.exe into each targeted user's AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup directory. The binary then runs on every subsequent Windows login, providing persistent code execution on the developer host independent of Node or npm. The filename (vite-native-helper.exe) is a cover-story mimicking a Vite build helper; the package name suggests an unrelated math utility.

Source: amazon-inspector (507ee02c9717d3b99be47ab3415800fa71477716fa6be6b953cb07e0574066aa)