MAL-2026-12003

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-test-mathcore/MAL-2026-12003.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12003
Published
2026-08-05T00:03:02Z
Modified
2026-08-05T00:38:07.047246957Z
Summary
Malicious code in streak-test-mathcore (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (cb5bc7a04c4f43370b3f93cf5e1bc9a84742a5043eefa7a4bba7ac1c53e01dd1)

Package main dist/index.mjs runs a top-level IIFE that spawns dist/math-core.bin via child_process.spawn on any import of the package. The bundled ELF is a remote-access implant that beacons to a hardcoded C2 at 217.60.77.63, accepts remote commands to execute shell, download and run ELF binaries and shellcode from http://217.60.77.63/Others/ and /SC/ endpoints (memfd/tmp chmod+x staging), enumerates and uploads host files including SSH keys, credentials, database contents, and clipboard via chunked POST /api/extract-receive, and installs user-level persistence by writing ~/.config/systemd/user/svc-update.service (labeled 'System Update Service') and running systemctl --user daemon-reload and enable --now. The JS wrapper describes the binary as a 'HIGH-PERFORMANCE MATH ENGINE LOADER' and wraps the spawn in a sham calibration loop; the README advertises dependency-free streak math, unrelated to the shipped binary.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T00:04:39.683490415Z",
            "sha256": "cb5bc7a04c4f43370b3f93cf5e1bc9a84742a5043eefa7a4bba7ac1c53e01dd1",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-011369",
            "modified_time": "2026-08-05T00:03:02Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / streak-test-mathcore

Package

Name
streak-test-mathcore
View open source insights on deps.dev
Purl
pkg:npm/streak-test-mathcore

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-test-mathcore/MAL-2026-12003.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "streak-test-mathcore-1.0.0.tgz",
            "hashes": {
                "sha1": "6fb25e1eece725a37df44da7e5f51feac290ed5d",
                "sha512_sri": "sha512-9NKUUoRxK0je/KBBMM4xmlvSOsrehbnqqJv7d+9VTmiIBs997FmWAvf4S3qd/RKN7CkM2NwMSkXF2Q1J/97rSA=="
            }
        }
    ],
    "evidence_files": [
        {
            "sha256": "64d7782262a50edc2df3a4724840f09a4bea4fc58f036e26d3c174809c596828",
            "path": "dist/index.mjs",
            "tlsh": "9f215161837d03142afc87569f2c915a0a7ae0233fa7c0addd1c9b4075874a6e7a5b4a"
        },
        {
            "sha256": "4537b1189ce419f1a595cf47216c03f80e9170ce80dad8d9227a1e52f9cb3466",
            "path": "dist/math-core.bin",
            "tlsh": "83531a2bbdc28e3fc084d53087dfd42269b5705aaa33712f26111f293d59a69473f72a"
        }
    ]
}