The streak-day-primitives npm package version 1.0.0 contains malicious code that executes upon import. It uses obfuscated hex-encoded strings to hide payload details and attempts a Windows Subsystem for Linux (WSL) to Windows escape. If the environment is Linux with WSL and the Windows filesystem is accessible, it downloads a tarball, extracts a payload executable into the Windows user's AppData directory, and creates a shortcut in the Windows Startup folder. This shortcut runs a malicious executable on the next Windows login, enabling attacker code execution on the Windows host. This behavior is unrelated to the package's advertised functionality as a dependency-free calendar-day arithmetic library.