The npm package calendar-streak-core@1.0.0 contains embedded malicious code that drops a Windows executable into the user's Startup folder, enabling persistent execution on Windows logon. The package falsely claims to be dependency-free and harmless, but it embeds a hex-encoded Windows PE executable that is decoded and written to %AppData%/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe. This behavior occurs immediately upon module import, allowing any project importing this package on Windows to gain persistent execution of the embedded binary.