The streak-daily-core npm package version 1.0.0 contains malicious code that executes a top-level asynchronous function to evade static analysis. When run on Linux inside Windows Subsystem for Linux (WSL) with NODE_ENV not set to 'production', it downloads and extracts a tarball from a third-party Backblaze URL, then spawns a detached binary. This binary is persistently launched on Windows startup by writing a launcher script into the Windows Startup folder from the WSL environment, enabling persistence on the Windows host while bypassing Windows-side scanning. The package uses obfuscation techniques by reconstructing strings from character codes to hide its behavior. The fetched content is neither verified nor pinned, increasing risk.