The streak-core-insights npm package version 1.0.0 contains malicious code that, when imported, runs an obfuscated initializer targeting Linux environments with WSL. It downloads and executes a binary from an anonymous Backblaze B2 bucket, then writes a launcher script into the Windows Startup folder to persistently execute the binary on Windows logon, effectively escaping the WSL sandbox. The malicious payload is unrelated to the package's advertised functionality and uses obfuscation to evade detection.