MAL-2026-11999

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-map-metrics/MAL-2026-11999.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-11999
Published
2026-08-05T00:03:48Z
Modified
2026-08-05T00:38:04.971058777Z
Summary
Malicious code in streak-map-metrics (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fb9123af3cafc613a53d0dc4ab34b30f955cab139b961dcd1c5f106e952332c3)

The package's main module dist/index.mjs, executed on any import or require of the package, concatenates an array of base64-encoded fragments into a Linux x86-64 ELF binary and passes it to helpers in dist/internal/daymath.mjs that create a directory, write the file to disk, chmod it 0755, and spawn it detached with stdio ignored after a randomized delay. The helpers are labeled with calendar/cache-style names and JSDoc ('Ensure directory exists', 'Save data to cache', 'Start a background task') while their bodies dynamically import node:fs and node:childprocess to perform the drop-and-run. The decoded ELF64 targets /lib64/ld-linux-x86-64.so.2 and imports TLSclientmethod, SSLCTXnew, SSLconnect, SSLread, SSLwrite, socket, bind, listen, getaddrinfo, gethostbyname, fork, setsid, dup2, execl, execv, and pthread_create — the shape of a TLS-based remote-shell implant that grants a remote peer command execution on the installer's host. The ELF is split into ~260-character base64 slices to defeat single-string signatures, and the README's 'tiny startup self-check, no postinstall' framing masks the import-time drop-and-execute.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T00:03:48Z",
            "sha256": "fb9123af3cafc613a53d0dc4ab34b30f955cab139b961dcd1c5f106e952332c3",
            "id": "IN-MAL-2026-011372",
            "versions": [
                "1.0.0"
            ],
            "import_time": "2026-08-05T00:04:39.960409978Z"
        }
    ]
}
References
Credits

Affected packages

npm / streak-map-metrics

Package

Name
streak-map-metrics
View open source insights on deps.dev
Purl
pkg:npm/streak-map-metrics

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-IkDtWd4PjDXP9bK7/dDrAKdwcEy32xIrhLJmfjNAE+ZjUlZ7XaaOgHg6fIm7l+lus5viUePhdZm2p4Pc5fsgjw==",
                "sha1": "912f4eb9733d5d130d9636a2f25d52eb25441958"
            },
            "filename": "streak-map-metrics-1.0.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "dist/index.mjs",
            "sha256": "d010a3f1797c2fb22fb7778a3a3a895f554a187b658512268fdffe2ddd9738ee",
            "tlsh": "ec834cf29a863c87a5b19d18d64138082d6c66832178d177fec863ebb3e5250df5ecb4"
        },
        {
            "path": "dist/internal/daymath.mjs",
            "sha256": "979124adb7a8ef046aabbf407bfd8f8df995ef54a8115d410824916b5e77ed74",
            "tlsh": "3c518497ffe56338c774d260894ac58bf379e2313eaac8da904c66501a46036963dfc9"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-map-metrics/MAL-2026-11999.json"