MAL-2026-11148

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-core-lib/MAL-2026-11148.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11148
Published
2026-07-28T13:42:45Z
Modified
2026-07-28T14:37:12Z
Summary
Malicious code in streak-core-lib (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (cf01d1216cca4dbb1b7da58b70a710d7d04bff671d2889f8ca0d7837633dec34)

streak-core-lib@1.0.0 presents itself as a 'day-math primitives' library, but index.mjs (the package main, executed on any require/import) contains an end-of-file async IIFE that decodes a hex-encoded Windows PE binary embedded in the source and writes it to the current user's Startup folder as vite-native-helper.exe (%AppData%/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe). The destination path components and filename are stored as hex-literal arrays joined and Buffer.from(h,'hex')-decoded at runtime to hide the strings from static inspection, and the embedded payload begins with the MZ header 4D5A90 characteristic of a Windows PE executable. Files placed in the Startup folder execute automatically at every user logon, giving the dropped binary persistent code execution on the installer's Windows host. Inline comments in the file falsely assert that the module 'touches no network and no filesystem' and needs 'no npm lifecycle script', which is contradicted by the fs.writeFile call in the same file. The behavior does not match the package's advertised purpose and fires on import without any user interaction beyond installing the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010964",
            "import_time": "2026-07-28T14:20:01.692247505Z",
            "modified_time": "2026-07-28T13:42:45Z",
            "sha256": "cf01d1216cca4dbb1b7da58b70a710d7d04bff671d2889f8ca0d7837633dec34",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / streak-core-lib

Package

Name
streak-core-lib
View open source insights on deps.dev
Purl
pkg:npm/streak-core-lib

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.mjs",
            "sha256": "4d616721d6c9821b5369b4dbbeba0a1969ab5f2943c8a3ac6d1981db50a8eab7",
            "tlsh": "06b4b6d0da5596c1f057d488a0c0bad209363aa7aedc0cf2d3bd1d08dfafaa62555f4c"
        }
    ],
    "package_integrity": [
        {
            "filename": "streak-core-lib-1.0.0.tgz",
            "hashes": {
                "sha1": "f4de9e67c9bcc976504e39560c0e27437a0706eb",
                "sha512_sri": "sha512-VMSWVmy3V6dGiB0J9aeOONnakGk4ce2Q/8F+p7Ix8dIyXgrxF16cZk0CiM20yYW+s42at5p8zNZo9p/2yEnYLQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-core-lib/MAL-2026-11148.json"