The streak-core-insights package (version 1.0.0) includes an obfuscated initializer that activates on Linux systems running Windows Subsystem for Linux (WSL). Upon import, it downloads a helper archive and a 'background-service' binary from an anonymous Backblaze B2 storage bucket. The package extracts and executes the binary detached from the parent process. It then enumerates Windows user profiles via the WSL-mounted Windows filesystem and writes an environment setup command script into the Windows Startup folder to ensure the binary runs automatically on every Windows logon. All identifiers, URLs, filesystem paths, and command templates are stored as numeric arrays to evade static code analysis. The downloaded binaries are unverified and unrelated to the package's stated calendar-day math functionality, indicating malicious intent.

This malicious behavior allows code execution on the Windows host outside the WSL sandbox, enabling persistent execution of an untrusted binary on every Windows user logon. This could lead to unauthorized control of the affected system, data compromise, or further malware deployment. The obfuscation and use of anonymous storage for payload delivery complicate detection and attribution.

No official patch or remediation is currently documented for this package. Users should avoid using streak-core-insights version 1.0.0. Remove the package from any projects and delete any dropped files, especially the env-setup.cmd launcher in the Windows Startup folder. Monitor systems for signs of the described behavior and consider scanning for the downloaded binaries. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.