The npm package streak-daykey-lib version 1.0.0 contains malicious code that, upon module load, downloads and executes an arbitrary binary from a base64-obfuscated Backblaze B2 URL. This behavior is hidden behind innocuous function names unrelated to the package's advertised functionality. Any user importing or requiring this package will silently execute this arbitrary code on their machine.