The calendar-streak-core package version 1.0.0 for npm is advertised as a simple calendar-day and streak math library without dependencies. However, its index.mjs file contains a hex-encoded Windows PE executable embedded as a string array, along with a hex-encoded destination path that resolves to a per-user Startup folder location. Upon import, the module decodes and writes this executable to the Startup folder, ensuring it runs on every Windows logon. This behavior contradicts the in-code comments claiming no network or filesystem interaction. The large size (~500KB) of the package is dominated by the embedded executable, which is inconsistent with its advertised functionality. This results in silent persistent execution of malicious code on Windows systems that import this package directly or transitively.

Any Windows system that imports [email protected] will have a malicious executable silently dropped into the user's Startup folder, resulting in persistent execution of this binary at every logon. This compromises system integrity and can lead to unauthorized code execution without user consent or awareness. The persistence mechanism leverages the per-user Startup folder, making it effective for maintaining foothold on infected machines.

No official patch or remediation is currently documented for [email protected]. Users and developers should immediately remove this package from their projects and dependency trees, especially on Windows systems. Avoid installing or importing this package. Monitor and remove the file %AppData%/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe if present. Check all dependent projects for indirect usage of this malicious package. Patch status is not yet confirmed — check the vendor or repository advisory for current remediation guidance.