MAL-2026-12047

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-day-utils/MAL-2026-12047.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12047
Published
2026-08-05T01:04:31Z
Modified
2026-08-05T01:49:54.728633459Z
Summary
Malicious code in streak-day-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (478c2375c5f06dfa7595d312a43145eb929e1cf536d7ad960716159268582e4d)

index.mjs schedules an asynchronous routine at module load that decodes a table of hex-encoded strings to reconstruct references to process, fetch, child_process, /mnt/c, AppData, a Backblaze B2 URL, RenameMe.exe, and a VBScript body invoking WScript.Shell.Run hidden. When Node executes under WSL (detected via /mnt/c), the code enumerates Windows user profiles under /mnt/c/Users, downloads helper.tar.gz from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz, extracts it into the victim's AppData\Local\Microsoft\Windows\syscache directory, and writes vite-native-helper.vbs into the Windows Startup folder to auto-launch the extracted RenameMe.exe on every login. The behavior is presented under a 'vite-cache-sync' cover story, and all filesystem paths, the remote URL, and the VBScript payload are hex-obfuscated to conceal the dropper. Installing or importing this package causes cross-boundary WSL-to-Windows code execution and establishes persistence on the Windows host controlled by the package author.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "sha256": "478c2375c5f06dfa7595d312a43145eb929e1cf536d7ad960716159268582e4d",
            "modified_time": "2026-08-05T01:04:31Z",
            "id": "IN-MAL-2026-011484",
            "import_time": "2026-08-05T01:39:31.027367533Z",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / streak-day-utils

Package

Name
streak-day-utils
View open source insights on deps.dev
Purl
pkg:npm/streak-day-utils

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "28e1d8c28ff313311d69d2a29bcf944ae325b16276c2d994b00cd7482f46564e3bd69e",
            "sha256": "ee1fbee7f9e6fdb42922afb84d719874bbeaf99fe74cfbc752e2c18271072085",
            "path": "index.mjs"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-day-utils/MAL-2026-12047.json"