The [email protected] package includes a hex-obfuscated routine triggered on module import when NODE_ENV is not 'production' and the environment is detected as WSL. It downloads a helper.tar.gz archive from a remote URL, extracts it into the Windows user's AppData Local path via the WSL mount point, and writes a command script into the Windows Startup folder to ensure persistent execution of RenameMe.exe on every Windows login. The malicious behavior is concealed by storing key strings as hex and reconstructing them at runtime. This behavior is unrelated to the package's declared functionality, indicating intentional malicious code insertion.

This malicious package can establish persistent malware on Windows hosts running WSL by downloading and installing an executable that auto-launches at user login. This can lead to unauthorized code execution and potential compromise of the affected system. The impact is limited to environments running WSL with NODE_ENV not set to 'production'.

No official patch or remediation is currently documented. Users should avoid using streak-count-core version 1.0.0 and remove it from their projects. Since the package performs malicious actions only when NODE_ENV is not 'production' and WSL is detected, setting NODE_ENV to 'production' is a partial mitigation but does not remove the malicious code. Users should audit dependencies for this package and remove any installed instances. Monitor for and delete the downloaded files and startup scripts if present.