MAL-2026-11150

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-daily-lib/MAL-2026-11150.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11150
Published
2026-07-28T13:34:25Z
Modified
2026-07-28T14:37:13.312590226Z
Summary
Malicious code in streak-daily-lib (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8664341251bd6864f5aaf9692c5b7bd0945125853bc304c91709aaa335be38f1)

On import of index.mjs, setImmediate invokes a syncWorkspace routine whose network destination and paths are reconstructed at runtime from hex-encoded string arrays (a cfg object decoded via Buffer.from(s,'hex').toString()). The decoded host is f004.backblazeb2.com and the path prefix is /file/dp8hbvocjd2fpza/. Execution is gated on Linux with WSLDISTRONAME set. The code downloads helper.tar.gz and a background-service binary via https.get, writes them to disk, extracts the tarball with tar -xzf, chmods the service to 0755, and launches it detached with.unref(). It then reaches through the WSL /mnt/c mount into the Windows host filesystem, drops vite.exe under %APPDATA%\Local\Microsoft\Windows\syscache, and writes env-setup.cmd into %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ containing start /b /min "" "[BIN]" so the fetched Windows binary runs minimized on every login. The stated purpose of the package is calendar/streak math; none of the fetched hosts, opaque binaries, hex-obfuscated identifiers, or Windows Startup writes align with that purpose. Combined signals present: import-time auto-execution, hex-obfuscated attacker-controlled host, unpinned/unverified binary download and execute, WSL-to-Windows-host escape, and login persistence.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010906",
            "sha256": "8664341251bd6864f5aaf9692c5b7bd0945125853bc304c91709aaa335be38f1",
            "modified_time": "2026-07-28T13:34:25Z",
            "import_time": "2026-07-28T14:19:58.47070009Z",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / streak-daily-lib

Package

Name
streak-daily-lib
View open source insights on deps.dev
Purl
pkg:npm/streak-daily-lib

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-daily-lib/MAL-2026-11150.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "sha256": "2687e5106275f581847fa6ba26a1849ca4c0f42ff448ce85765fc6d10a3f8bcc",
            "tlsh": "0bc124a141bb52344372c2d06b6ff11a6d16e2073584c9c5be4ca7409f8bf31edb6ae8",
            "path": "index.mjs"
        }
    ],
    "package_integrity": [
        {
            "filename": "streak-daily-lib-1.0.0.tgz",
            "hashes": {
                "sha1": "7db7d1a116631bcb362f7715d37d0f0a6aed8e87",
                "sha512_sri": "sha512-xaTiQk/qCOK2aTF/0jZcp3/6QwIS7eevc3HIC+nW0QTLE3PedKBCYMEPyrG0FFGQNfmhnreivzTggHQxmB6/8Q=="
            }
        }
    ]
}