The streak-daybucket package version 1.0.0 for npm masquerades as a day-bucket and streak math utility but includes a hidden malicious payload. Its index.mjs file contains hex-encoded data representing a Windows PE executable and path components that resolve to the Startup folder path for the current user. When the package is imported or required, the module decodes these hex arrays and writes the executable file named vite-native-helper.exe into the user's Startup directory. This causes the executable to run automatically on the next Windows login, enabling persistent code execution. The payload is obfuscated by splitting the hex strings to evade static detection, while the rest of the module appears as normal math helper code.

Any system that installs and imports [email protected] on Windows will have a malicious executable planted in the user's Startup folder, resulting in persistent execution of unauthorized code upon user login. This compromises the affected host's security and may allow attackers to maintain long-term access or perform further malicious actions.

No official patch or remediation is currently available for [email protected]. Users and organizations should avoid installing or importing this package. Remove any existing installations of [email protected] and delete the vite-native-helper.exe file from the Startup folder if present. Monitor dependency usage to prevent transitive inclusion of this malicious package.