MAL-2026-12345

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/calendar-streak-core/MAL-2026-12345.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12345
Published
2026-08-05T12:24:56Z
Modified
2026-08-05T13:35:01.179693052Z
Summary
Malicious code in calendar-streak-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d34b4caa6716625380bd2636072e5fe0473d114ab3fdfd8335f9e1c0e642ddc4)

calendar-streak-core@1.0.0 is advertised as a dependency-free calendar-day and streak math library, but index.mjs embeds a hex-encoded Windows PE executable (MZ header) in a _bin string array together with a hex-encoded destination path that decodes to %AppData%/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe. A _decode helper (Buffer.from(h,'hex').toString()) and a block labeled 'Decode and write embedded payload' execute at top-level module import, dropping the executable into the per-user Startup folder so it runs on every subsequent Windows logon. In-code comments claim the module 'touches no network and no filesystem' while the code performs exactly that. Both the payload bytes and the destination path are stored as split hex fragments joined at runtime to evade string-level inspection, and the shipped module is ~500KB dominated by the encoded PE, which is inconsistent with the advertised calendar-math scope. Any project on Windows that imports (directly or transitively) this package gains persistent execution of the embedded binary at logon.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014646",
            "modified_time": "2026-08-05T12:24:56Z",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "import_time": "2026-08-05T13:08:33.438237885Z",
            "sha256": "d34b4caa6716625380bd2636072e5fe0473d114ab3fdfd8335f9e1c0e642ddc4"
        }
    ]
}
References
Credits

Affected packages

npm / calendar-streak-core

Package

Name
calendar-streak-core
View open source insights on deps.dev
Purl
pkg:npm/calendar-streak-core

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/calendar-streak-core/MAL-2026-12345.json"
indicators 
{
    "evidence_files": [
        {
            "path": "index.mjs",
            "sha256": "6544fe39b486e24e9c897af377e152ba242b30b049a1274a090e92dd79176690",
            "tlsh": "ecb4c5e0da459681f15bd488b0c0bed209353697badc0cf2d3be1d08dfafaa62555b4c"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "830243bec7f13da1cdfde921e1948aa1889d44a1",
                "sha512_sri": "sha512-XZzzLpPjd6OHUOQLElhrMD117TQdVK/vD2wzAsQGJJ6ql/R3w4+/UTwjP1Tts59kF76m1Qw3EwpYiHbPYOXP0w=="
            },
            "filename": "calendar-streak-core-1.0.0.tgz"
        }
    ]
}