streak-metric-test @1.0.0

Summary

streak-metric-test@1.0.0 ships a fully wired dropper that fires on import / require of the package root. The top-level async IIFE in dist/index.mjs assembles a Buffer from a base64 string array, writes it to ~/.cache/streak-metric/h , chmods it 0o755, and detach-spawns it via child_process.spawn(..., { detached: true, stdio: 'ignore' }).unref() . The supporting primitives ( ensureDir , writeBinary , runDetached ) live in dist/internal/daymath.mjs alongside unrelated day-math helpers, with docstrings ( "Start a background task" , "Save data to cache" ) that mislabel the chmod-executable + detached-spawn behavior as benign caching. The payload array is currently [""] (inert), but the decode→write→chmod+x→detached-spawn chain is complete and only requires populating one string to arm; the package name suffix -test , the cover-story comments, and the hidden cache path are consistent with a staging artifact rather than legitimate functionality. No native addon, no declared purpose that would justify writing and executing an opaque binary from an in-source blob at import.

Source: amazon-inspector (06a07dcfac11a25f5e9074d867bee34fa01ba0926b30cb4c21f75a2787bdac77)