MAL-2026-12461

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (ea29201e3cd49e11201222e430bd1787a1b00abdc46fad18908d0033459ed2d7) streak-daily-core@1.0.0's main entry (index.mjs) runs a top-level async IIFE that reconstructs identifiers, paths, and URLs from char-code arrays to evade static analysis. When the runtime is Linux inside WSL and NODE_ENV is not 'production', it fetches https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz over HTTPS, extracts it with `tar -xzf` into a cache directory, and spawns a second binary (/background-service) as a detached process. It then reaches from WSL into the Windows host filesystem at /mnt/c/Users/<user>/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup and writes an env-setup.cmd launcher that re-executes the dropped binary on every Windows logon, establishing persistence on the Windows host from the Linux side to bypass Windows-side scanning. Module names ('process','fs','https','child_process','spawn'), the WSL_DISTRO_NAME env-var name, the Backblaze URL, the tar arguments, the Startup-folder path, and the.cmd template are all stored as numeric arrays and reassembled via String.fromCharCode. Fetched content is not pinned, hashed, or signature-verified, and the destination is a mutable third-party file host unrelated to the declared package purpose.