The streak-day-engine package version 1.0.0 includes a hex-obfuscated top-level async immediately-invoked function expression (IIFE) that runs on module import. It decodes obfuscated identifiers and constants to fetch a remote tar.gz archive from a suspicious URL, writes and extracts it under the user's AppData directory, and creates a Visual Basic Script launcher in the Windows Startup folder. This launcher executes a hidden executable named RenameMe.exe at every user login, enabling persistent attacker-controlled code execution on the host system.

This malicious package results in the silent installation of attacker-controlled files on the victim's machine and establishes a persistent backdoor that executes on every Windows user login. This can lead to unauthorized remote code execution and system compromise.

No official patch or remediation is currently available. Users should avoid installing or importing the streak-day-engine package version 1.0.0. Remove any installed instances of this package and manually delete the downloaded files and startup scripts from the AppData directory and Windows Startup folder. Monitor for suspicious processes and files related to this threat. Patch status is not yet confirmed — check the vendor advisory or trusted sources for current remediation guidance.