The streak-calendar-core package version 1.0.0 includes an index.mjs file that executes automatically on import. Under conditions where it detects WSL (via WSL_DISTRO_NAME environment variable and Linux platform) and NODE_ENV is not set to production, it downloads a remote archive from an unrelated host (https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz) without integrity verification. It extracts this archive to a Windows host path (/mnt/c/Users/<user>/AppData/Local/Microsoft/Windows/syscache) and writes an environment setup launcher script into the Windows Start Menu Startup folder to ensure the dropped executable runs on every Windows login. The code uses hex-encoded strings to hide network destinations, module names, environment variables, and file paths, reconstructing them at runtime. This behavior effectively allows the malicious package to compromise the Windows host from a Linux Node.js environment running inside WSL.

This malicious package enables persistent compromise of Windows hosts from within WSL by installing a launcher that executes on every Windows login. It bypasses typical Node.js environment boundaries by crossing from Linux subsystem to Windows filesystem and startup processes. The unpinned, integrity-unchecked remote fetch increases the risk of supply chain compromise and remote code execution on affected systems.

No official patch or remediation is currently documented. Users should avoid using streak-calendar-core version 1.0.0 and remove it if already installed. Since the package fetches and executes remote code without integrity checks, it is recommended to audit and restrict usage of untrusted npm packages, especially those running in WSL environments. Monitor and clean any unauthorized files in Windows startup folders and the specified syscache directory. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.