The streak-day-primitives npm package version 1.0.0 contains top-level code that runs on import and uses hex-encoded strings to conceal module names, remote URLs, and payload details. When executed in a Linux environment with WSL configured and access to the Windows filesystem, it downloads a malicious tarball from a remote URL, extracts it into the Windows user's AppData directory, and uses PowerShell commands along with WScript.Shell COM objects to create a shortcut in the Windows Startup folder. This shortcut points to a malicious executable (RenameMe.exe), which executes on the next Windows login, effectively allowing code execution on the Windows host via a WSL-to-Windows escape. This malicious behavior is hidden from static analysis by obfuscation and is unrelated to the package's stated purpose.

Successful execution of this malicious package in a WSL-enabled Linux environment with access to the Windows filesystem results in persistent code execution on the Windows host at the next user login. This can lead to unauthorized control over the Windows system, potentially allowing further compromise or persistence. The attack bypasses the expected functionality of the package and leverages obfuscation to evade detection.

No official patch or remediation is currently documented for this malicious package version. Users should avoid installing or using streak-day-primitives version 1.0.0. Review and remove this package if present in your environment. Employ supply chain security best practices such as verifying package integrity and using trusted sources. Monitor for suspicious startup shortcuts and unexpected executables in user AppData directories on Windows hosts, especially in environments using WSL.