The streak-count-core npm package version 1.0.0 contains malicious code that executes a hex-obfuscated routine when imported outside of production environments. It detects if running in a Windows Subsystem for Linux (WSL) environment and then downloads and extracts a Windows executable to the user's profile directory. The package also sets up persistence by placing a script in the Windows Startup folder to auto-launch the malicious executable on every login. This behavior is unrelated to the package's declared purpose as a streak counter library.