Malicious code in lib-streak-math (npm)

The npm package lib-streak-math was published with malicious code disguised as a math helper library. The package's main entry point (index.mjs) contains a top-level async IIFE that executes whenever the module is imported or required, regardless of whether the advertised math functions are actually used.\n\nThe malicious code uses obfuscation techniques to hide its true intent: network destinations, filesystem paths, subprocess names, and Node.js built-in module names are encoded as integer arrays and decoded at runtime using a character-code decoder function. This decoding reveals usage of fs/promises, path, child_process, and node-fetch modules.\n\nWhen executed, the payload downloads a file from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz and extracts it to a hidden directory. On Windows systems, it writes a launcher script (env-setup.cmd) to the Startup folder for persistence and executes a vite.exe binary on each login. On Linux systems, it writes and executes a background-service binary as a detached process that survives the parent.\n\nThe package was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.