The streak-calendar-core npm package version 1.0.0 contains malicious code that executes upon module import. When run inside Windows Subsystem for Linux (WSL) with specific environment conditions, it fetches and extracts a remote archive onto the Windows host filesystem and installs a launcher script in the Windows Startup folder to persistently execute on login. The malicious payload is obfuscated using hex-encoded strings and crosses the WSL boundary to compromise the Windows host from a Linux Node environment.