MAL-2026-12001

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-metricazbd/MAL-2026-12001.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12001
Published
2026-08-05T00:03:12Z
Modified
2026-08-05T00:38:06.558449079Z
Summary
Malicious code in streak-metricazbd (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4875da8c750beede70a9031fdd1cf1aa402c49cd94da3abbcd1964a4160a271b)

On import of the package, dist/index.mjs runs an IIFE that copies a bundled Linux x8664 ELF (dist/math-core.bin) to /tmp/sm-engine-runtime/math-core.bin and spawns it via childprocess.spawn, framed as 'math-core engine calibration' and wrapped in an error-swallowing try/catch. The dropped binary is a full remote-access implant identifying itself as 'RedShell': it beacons to a hardcoded remote server at 217.60.77.63, accepts commands over that channel to execute arbitrary shell commands via /bin/sh and /bin/bash, provides SOCKS5 proxying and TCP port forwarding, downloads and executes additional ELF/shellcode payloads, installs systemd --user persistence disguised as 'svc-update.service', and exposes /ssh_keys, /creds, /dbfind, /env, /dataextract, and /download commands that harvest installer SSH keys, credentials, and arbitrary files and exfiltrate them in chunks via POST /api/extract-receive. Any host that imports this package hands full remote control and credential access to the operator of 217.60.77.63.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T00:04:39.777648339Z",
            "modified_time": "2026-08-05T00:03:12Z",
            "sha256": "4875da8c750beede70a9031fdd1cf1aa402c49cd94da3abbcd1964a4160a271b",
            "id": "IN-MAL-2026-011370",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / streak-metricazbd

Package

Name
streak-metricazbd
View open source insights on deps.dev
Purl
pkg:npm/streak-metricazbd

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-X656C3qeSmHNPqiGIfcrgOJOvXOMtXgiXJ7KuipZEFhGb04pCbiTsidihY98otvWUCUOY1lj0l0bXkZFIRrvpQ==",
                "sha1": "612c471cdb811b03de545f5765a46d139baf85ac"
            },
            "filename": "streak-metricazbd-1.0.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "dist/index.mjs",
            "sha256": "7a5221c06710393fc3893ef8b697bf8a2a24c63b3b8fde77433a9516127cba4d",
            "tlsh": "36314663833e277816f88351eb3d5286063ec4633792d8a9ec5c17903902559ef79b9b"
        },
        {
            "path": "dist/math-core.bin",
            "sha256": "4537b1189ce419f1a595cf47216c03f80e9170ce80dad8d9227a1e52f9cb3466",
            "tlsh": "83531a2bbdc28e3fc084d53087dfd42269b5705aaa33712f26111f293d59a69473f72a"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-metricazbd/MAL-2026-12001.json"