MAL-2026-12114

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-calc-math/MAL-2026-12114.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12114
Published
2026-08-05T06:22:22Z
Modified
2026-08-05T07:21:27.559314120Z
Summary
Malicious code in streak-calc-math (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e44658b7cae20032e83c5394b65958b61b5e9c4976abe51e4eb28b8056fd86a7)

streak-calc-math@1.0.0 bundles a Linux x8664 ELF at dist/math-calc.bin and launches it unconditionally when the package is imported. The top-level IIFE in dist/index.mjs chmod 0755's the binary and cp.spawn's it detached with piped stdio. A sha256 'integrity verification' against a placeholder constant is a decoy: when the computed hash does not match, execution proceeds anyway; only a log line changes. The ELF is a full RedShell remote-access implant beaconing to hardcoded C2 IP 217.60.77.63 (SECUREBEACON|...|REDSHELL framing). Operator capabilities include arbitrary shell execution via /bin/sh and /bin/bash, SOCKS5 proxy, TCP port-forward, tunnel relay, and remote payload staging that curls additional ELFs and shellcode over plain HTTP from http://217.60.77.63/Others/ and /SC/ into /tmp or an anonymous memfd (memfdcreate syscall 319 invoked via python3 ctypes) and executes them. Operator commands /sshkeys, /creds, /dbfind, /download, /dataextract and a chunked BIGEXTRACT upload path harvest ~/.ssh keys, credential files, and database files and POST them to http://217.60.77.63/api/extract-receive. Persistence is installed via /redshell persist by writing a user systemd unit at ~/.config/systemd/user/svc-update.service (Description='System Update Service', ExecStart=/proc/self/exe, Restart=always) and enabling it with systemctl --user. The package name and 'high-performance math accelerator' framing are a cover story for a backdoor with no legitimate math functionality.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T07:06:47.288681459Z",
            "modified_time": "2026-08-05T06:22:22Z",
            "sha256": "e44658b7cae20032e83c5394b65958b61b5e9c4976abe51e4eb28b8056fd86a7",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-013432",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / streak-calc-math

Package

Name
streak-calc-math
View open source insights on deps.dev
Purl
pkg:npm/streak-calc-math

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "streak-calc-math-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-/4SmtMan0By9XgwjShrcYrqKDmvcP9Rl0tWNpL8kamszwyMnFFa8SBrp7MZSTVoSBfa1ZfMbhcPM5Da3M3Jv9A==",
                "sha1": "41961eeade4856e7a27db8b7d1af68b65a9a7fcc"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "32312366affd632497fc07438e3d71931a1a88431f86d898d95d472970c076ce3d4a7a",
            "sha256": "f71ffec658eb31fb2292f83e02f9451acb6a6d70f1b7988d9ccc308286b288b9",
            "path": "dist/index.mjs"
        },
        {
            "tlsh": "83531a2bbdc28e3fc084d53087dfd42269b5705aaa33712f26111f293d59a69473f72a",
            "sha256": "4537b1189ce419f1a595cf47216c03f80e9170ce80dad8d9227a1e52f9cb3466",
            "path": "dist/math-calc.bin"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-calc-math/MAL-2026-12114.json"