The streak-day-engine npm package version 1.0.0 contains malicious code that executes immediately upon import or require. It downloads a remote archive, extracts it into the user's AppData directory, and installs a persistent Windows startup script that runs a hidden executable on every user login. This establishes a persistent execution channel controlled by an attacker.