The streak-daykey-lib npm package version 1.0.0 includes a malicious dropper mechanism triggered on module load. The index.mjs file calls flushInternalData(), which creates a cache directory, downloads a binary executable from a base64-encoded Backblaze B2 URL, writes it with executable permissions, and spawns it detached with ignored stdio. The network destination is obfuscated via base64 encoding to evade casual detection. This malicious behavior is unrelated to the package's stated purpose of calendar-day and streak calculations, indicating deliberate concealment of the payload delivery.

Any consumer that installs or imports streak-daykey-lib version 1.0.0 will unknowingly download and execute an arbitrary executable on their system. This can lead to full compromise of the affected machine depending on the payload's capabilities. The execution is detached and silent, increasing the risk of unnoticed infection.

No official patch or remediation is currently documented. Users should immediately avoid installing or importing streak-daykey-lib version 1.0.0. Remove the package if already installed and scan affected systems for the downloaded binary and any related malicious activity. Monitor for updates or advisories from the package maintainers or npm registry regarding this malicious package.