The streak-math-lib npm package version 1.0.0 contains malicious code that activates when imported under Windows Subsystem for Linux (WSL) environments with NODE_ENV not set to 'production'. It downloads and extracts a Windows executable from a Backblaze B2 cloud bucket, installs it into the user's AppData directory, and sets up persistence by placing a loader script in the Windows Startup folder to execute the binary on next login. The malicious payload and persistence mechanism are obfuscated using hex-encoded strings and conditional execution checks.