The streak-bucket-core npm package version 1.0.0 contains embedded malicious code that writes a Windows PE executable to the current user's Startup folder upon import or require on Windows hosts. This executable, disguised as vite-native-helper.exe, is configured to auto-run at every user logon, enabling persistent execution. The malicious payload is concealed via hex encoding and embedded directly at the module's top level, making the infection automatic upon usage of the package.