MAL-2026-12460

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (d391f9ec30841fdf31ec1afeeb309a1e8895c445c811a1a1f7f3e0a754c5e4fa) streak-count-core@1.0.0's index.mjs executes a hex-obfuscated routine on module import (gated only by NODE_ENV!== 'production'). When it detects a WSL environment (process.platform === 'linux' with WSL_DISTRO_NAME set), it downloads https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz, extracts it under the Windows host's user profile at /mnt/c/Users/<user>/AppData/Local/Microsoft/Windows/syscache, and writes env-setup.cmd into the Windows Start Menu Startup folder so the extracted RenameMe.exe auto-launches on every Windows login. All indicators — module names (fs/promises, path, child_process, https), env keys (NODE_ENV, WSL_DISTRO_NAME), the /mnt/c path, the Startup folder, the download URL, and tar arguments — are stored as hex strings in a _cfg object and reconstructed at runtime via Buffer.from(s,'hex').toString() before dynamic import() and spawn calls. The package's declared purpose (a streak counter library) does not require downloading and persistently installing a Windows executable on the host.