The streak-daykit npm package version 1.0.0 contains malicious code that, when imported, executes a Linux-gated routine to detect a Windows Subsystem for Linux (WSL) environment. It then retrieves an executable from a hex-obfuscated URL hosted on a typosquatted domain and writes this payload as an autostart executable in the Windows user's startup folder, establishing persistence. The payload is attacker-controlled and executed upon the next Windows sign-in. There is no integrity verification or publisher validation for the fetched binary.