MAL-2026-12002

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-metricsazb/MAL-2026-12002.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12002
Published
2026-08-05T00:03:32Z
Modified
2026-08-05T00:38:06.588459979Z
Summary
Malicious code in streak-metricsazb (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bc4ea1b382140e833e01605ec5278b7a9a877aaaddd96ea9057efef2560b66b2)

On import of the package's main entry, a top-level async IIFE in index.mjs (labelled 'ENGINE INITIALIZATION & CALIBRATION') copies the shipped file dist/cache.bin to os.tmpdir()/sm-engine-runtime/math-core.bin and spawns it via childprocess.spawn. The dropped ELF is a full Linux implant containing a hardcoded C2 at 217.60.77.63, a SECUREBEACON|...|REDSHELL beacon protocol, a remote-shell dispatcher invoking /bin/sh and /bin/bash on C2-supplied input, SOCKS5 proxy and TCP port-forwarding, staged payload execution via curl plus memfd/mktemp, and systemd --user persistence via svc-update.service. The implant exposes beacon commands /ssh_keys, /creds, /dbfind, /download, /upload, /dataextract, and /clipboard, and exfiltrates collected data through POST /api/extract-receive on the C2. The package advertises calendar and streak math primitives; the calibration/JIT wording in the surrounding comments is a cover story contradicted by the binary's contents.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T00:03:32Z",
            "sha256": "bc4ea1b382140e833e01605ec5278b7a9a877aaaddd96ea9057efef2560b66b2",
            "id": "IN-MAL-2026-011371",
            "versions": [
                "1.0.0"
            ],
            "import_time": "2026-08-05T00:04:39.871318656Z"
        }
    ]
}
References
Credits

Affected packages

npm / streak-metricsazb

Package

Name
streak-metricsazb
View open source insights on deps.dev
Purl
pkg:npm/streak-metricsazb

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-+qTd0YnrYzdsH3q/SNj9jbAtsDabmep4HQR7wVKAGPGGubZGGjo98sqSNzkrMW0P3HFiRtp4u9pdUStW92P1rA==",
                "sha1": "aec72c4cb7f91f02c164ab7dbde194cff5702de9"
            },
            "filename": "streak-metricsazb-1.0.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "dist/index.mjs",
            "sha256": "3ca67aa27a7544cfbc8a6b8b73628d6217560cd5f6e13fb167985689ab7bbff0",
            "tlsh": "c5311e66973f17b416f8c7419f3c92894a3e96533ac2cca9ac5c0b802503419da69b97"
        },
        {
            "path": "dist/cache.bin",
            "sha256": "4537b1189ce419f1a595cf47216c03f80e9170ce80dad8d9227a1e52f9cb3466",
            "tlsh": "83531a2bbdc28e3fc084d53087dfd42269b5705aaa33712f26111f293d59a69473f72a"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-metricsazb/MAL-2026-12002.json"