MAL-2026-11548

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-math-abz/MAL-2026-11548.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11548
Published
2026-08-04T22:06:35Z
Modified
2026-08-04T23:05:33.536526146Z
Summary
Malicious code in streak-math-abz (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a1eddf7b9d6d5331bdc1c1afe40913620b219afcc06a705aef3fe547ddc5cf25)

The package advertises itself as a JavaScript day-math helper but its ESM main entry (dist/index.mjs) unconditionally spawns a bundled Linux x8664 ELF (dist/math-core.bin) via childprocess.spawn at import time, disguised by 'CORE ENGINE INITIALIZATION' comments and a fake calibration loop wrapped in an empty catch. The ELF is a remote-access implant with a hardcoded C2 at 217.60.77.63: it exposes a /redshell command surface with SOCKS5 proxy, TCP port forwarding, and shell/binary dispatch; it drops and executes attacker-supplied ELF/shellcode payloads staged under /tmp/.elfXXXXXX via curl to http://217.60.77.63/Others/ and /SC/; it exfiltrates arbitrary files and credentials (/sshkeys, /creds, /dbfind, /download, /dataextract) by POSTing chunked BIGEXTRACT_START/FILE/END frames to http://217.60.77.63/api/extract-receive; and its /persist command installs a systemd user service at ~/.config/systemd/user/svc-update.service with ExecStart=/proc/self/exe and Restart=always, enabled via systemctl --user, for reboot-persistent execution. The binary performs no math and has no build/source correspondence in the package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "a1eddf7b9d6d5331bdc1c1afe40913620b219afcc06a705aef3fe547ddc5cf25",
            "modified_time": "2026-08-04T22:06:35Z",
            "import_time": "2026-08-04T22:30:11.408371496Z",
            "id": "IN-MAL-2026-011334",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / streak-math-abz

Package

Name
streak-math-abz
View open source insights on deps.dev
Purl
pkg:npm/streak-math-abz

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "sha256": "7fcc2baa9d65c190a07add27f84ad0644ac77a62eeb5a49062bad290133e2cd6",
            "path": "dist/index.mjs",
            "tlsh": "c82110b1476d175452fc4b829f0c928b0e79d0633fa6c069dc5c5790f683569e364b89"
        },
        {
            "sha256": "4537b1189ce419f1a595cf47216c03f80e9170ce80dad8d9227a1e52f9cb3466",
            "path": "dist/math-core.bin",
            "tlsh": "83531a2bbdc28e3fc084d53087dfd42269b5705aaa33712f26111f293d59a69473f72a"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-jP83u5BmDsCeqiq2zpB4FQ8SR2vVVwWnwtIYGueRFYAsRA98knFORZ8Mf3KDrREj4QLj3G3G+bXRKZqRhFDcBg==",
                "sha1": "74d988341e8e3e945be05d980ebadd3aafc02c2d"
            },
            "filename": "streak-math-abz-1.0.0.tgz"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-math-abz/MAL-2026-11548.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]