🛡️ MAL-2026-12463 — streak-day-primitives

Malicious code in streak-day-primitives (npm)

Source: amazon-inspector

The package advertises itself as dependency-free calendar-day arithmetic, but index.mjs contains top-level code that runs on import. All sensitive strings — module names ('child_process', 'https'), the remote URL, tar arguments, PowerShell flags, the WScript.Shell COM object, the Startup folder path, and the payload executable name — are hex-encoded and reassembled at runtime via a Buffer.from(s,'hex').toString() helper (_d + _k table) to hide the payload from static review. When the host is Linux with WSL_DISTRO_NAME set and /mnt/c is reachable, the code fetches a tarball from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz, extracts it into the Windows user's AppData tree, and uses PowerShell (-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass) plus WScript.Shell CreateShortcut to drop a.lnk pointing at the extracted RenameMe.exe into the Windows user's Startup folder. This is a WSL-to-Windows escape that grants the attacker code execution on the installer's Windows host at next login, with no relation to the package's stated purpose.