Malicious code in streak-metric-test (npm)

The npm package streak-metric-test@1.0.0 contains malicious code in its dist/index.mjs file that executes immediately upon import or require. The package implements a complete dropper chain: a top-level async IIFE decodes a base64 string array into a Buffer, writes it to ~/.cache/streak-metric/h, sets executable permissions (0o755), and spawns it as a detached background process.\n\nThe supporting functions (ensureDir, writeBinary, runDetached) are located in dist/internal/daymath.mjs alongside legitimate day-math utilities, with misleading docstrings that describe the chmod-executable and detached-spawn behavior as benign caching operations. This obfuscation pattern, combined with the package name suffix "-test" and hidden cache path, suggests a staging artifact rather than legitimate functionality.\n\nThe payload array is currently empty ("[\"\"]"), rendering the dropper inert, but the full decode→write→chmod+x→detach-spawn infrastructure is complete and functional. Only populating the base64 string would be required to activate the malicious behavior. There is no declared purpose, native addon, or legitimate use case that would justify writing and executing an opaque binary from an embedded blob at import time.\n\nThe package was identified by the OpenSSF malicious-packages project (MAL-2026-14224)."