MAL-2026-12458

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-calendar-core/MAL-2026-12458.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12458
Published
2026-08-05T12:33:17Z
Modified
2026-08-05T13:36:06.400922646Z
Summary
Malicious code in streak-calendar-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a2544026164712ffe31b1007b7cb23f36f8cd05134a638dedbd6e8ae3539a084)

index.mjs executes on module import and, when running inside WSL (gated on WSLDISTRONAME, linux platform, and NODEENV!=production), fetches a remote archive from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz, extracts it via tar to /mnt/c/Users/<user>/AppData/Local/Microsoft/Windows/syscache on the Windows host filesystem, and writes an env-setup.cmd launcher into the Windows Start Menu Startup folder (AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/) so the dropped executable auto-runs on every Windows login. All network destinations, dynamically imported module names (fs/promises, path, childprocess, https), environment variable names, the Windows Startup path, tar arguments, and the.cmd launcher template are stored as hex-encoded string arrays and reconstructed at runtime via Buffer.from(h,'hex'). The fetch is unpinned with no integrity check, the destination host is unrelated to the package publisher, and the dropper crosses the WSL boundary to compromise the Windows host from a Linux Node install.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.0"
            ],
            "sha256": "a2544026164712ffe31b1007b7cb23f36f8cd05134a638dedbd6e8ae3539a084",
            "import_time": "2026-08-05T13:08:39.175721724Z",
            "id": "IN-MAL-2026-014703",
            "modified_time": "2026-08-05T12:33:17Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / streak-calendar-core

Package

Name
streak-calendar-core
View open source insights on deps.dev
Purl
pkg:npm/streak-calendar-core

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "streak-calendar-core-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-pH8Mzl/kl6/0Hcon9AlBfoXJNz3BwE+hP8t3/415XU43DQffgRTPmDIqMO2L/EtTj8IBdL23ae3TMiWsptD6tA==",
                "sha1": "e9d97437672eae968155e475ba250e51d6a50032"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "index.mjs",
            "sha256": "dbfc2282d1e791e9f87314aaf047ed314a54d2fbba79ace38bc959917cb0aaa5",
            "tlsh": "3ce1d6e69bb353f11665c2e1960fc55aab1da01137a5dec0b81c66c00fc3a32d1bbdda"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-calendar-core/MAL-2026-12458.json"