The npm package streak-daybucket@1.0.0 contains malicious code that embeds a hex-encoded Windows executable. Upon loading the module, this executable is decoded and written to the current user's Windows Startup folder, causing it to run automatically on the next login. This behavior establishes persistent code execution on the affected system. The malicious payload is obfuscated by splitting hex arrays and disguising the package as a legitimate math utility.