MAL-2026-12458

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-calendar-core/MAL-2026-12458.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12458
Aliases
  • GHSA-6vcc-7wg6-pwfr
Published
2026-08-05T12:33:17Z
Modified
2026-08-26T01:12:24Z
Summary
Malicious code in streak-calendar-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a2544026164712ffe31b1007b7cb23f36f8cd05134a638dedbd6e8ae3539a084)

index.mjs executes on module import and, when running inside WSL (gated on WSL_DISTRO_NAME, linux platform, and NODE_ENV!=production), fetches a remote archive from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz, extracts it via tar to /mnt/c/Users//AppData/Local/Microsoft/Windows/syscache on the Windows host filesystem, and writes an env-setup.cmd launcher into the Windows Start Menu Startup folder (AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/) so the dropped executable auto-runs on every Windows login. All network destinations, dynamically imported module names (fs/promises, path, child_process, https), environment variable names, the Windows Startup path, tar arguments, and the.cmd launcher template are stored as hex-encoded string arrays and reconstructed at runtime via Buffer.from(h,'hex'). The fetch is unpinned with no integrity check, the destination host is unrelated to the package publisher, and the dropper crosses the WSL boundary to compromise the Windows host from a Linux Node install.

Source: ghsa-malware (c019f29fbe5fc72f791d9b0bb1cf66894be0f5ad94d6fabb3146ef6f81b43e03)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014703",
            "import_time": "2026-08-05T13:08:39.175721724Z",
            "modified_time": "2026-08-05T12:33:17Z",
            "sha256": "a2544026164712ffe31b1007b7cb23f36f8cd05134a638dedbd6e8ae3539a084",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "GHSA-6vcc-7wg6-pwfr",
            "import_time": "2026-08-25T15:30:22.782451693Z",
            "modified_time": "2026-08-25T14:38:19Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "sha256": "c019f29fbe5fc72f791d9b0bb1cf66894be0f5ad94d6fabb3146ef6f81b43e03",
            "source": "ghsa-malware"
        }
    ]
}
References
Credits

Affected packages

npm / streak-calendar-core

Package

Name
streak-calendar-core
View open source insights on deps.dev
Purl
pkg:npm/streak-calendar-core

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.mjs",
            "sha256": "dbfc2282d1e791e9f87314aaf047ed314a54d2fbba79ace38bc959917cb0aaa5",
            "tlsh": "3ce1d6e69bb353f11665c2e1960fc55aab1da01137a5dec0b81c66c00fc3a32d1bbdda"
        }
    ],
    "package_integrity": [
        {
            "filename": "streak-calendar-core-1.0.0.tgz",
            "hashes": {
                "sha1": "e9d97437672eae968155e475ba250e51d6a50032",
                "sha512_sri": "sha512-pH8Mzl/kl6/0Hcon9AlBfoXJNz3BwE+hP8t3/415XU43DQffgRTPmDIqMO2L/EtTj8IBdL23ae3TMiWsptD6tA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-calendar-core/MAL-2026-12458.json"