MAL-2026-12459

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-core-insights/MAL-2026-12459.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12459
Published
2026-08-05T12:49:23Z
Modified
2026-08-05T13:36:06.657306009Z
Summary
Malicious code in streak-core-insights (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (54c92b91e60c1852de5e84952155bf8aadca8ca1a0e7e784e0e1fa4d25e8c641)

The package advertises calendar-day math but on module import runs an obfuscated initializer that gates on Linux + WSLDISTRONAME, then downloads helper.tar.gz and a 'background-service' binary from an anonymous Backblaze B2 bucket (https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/), extracts the archive, and spawns the binary detached. The initializer then enumerates /mnt/c/Users to locate a Windows profile and writes an env-setup.cmd launcher into the Windows Startup folder (AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup) so the dropped executable auto-runs on every Windows logon, escaping the WSL sandbox. All identifiers, URLs, filesystem paths, and the.cmd template are stored as String.fromCharCode numeric arrays to defeat static inspection. The fetched binaries are unpinned, unverified, and unrelated to the stated purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.0.0"
            ],
            "import_time": "2026-08-05T13:08:45.50994585Z",
            "sha256": "54c92b91e60c1852de5e84952155bf8aadca8ca1a0e7e784e0e1fa4d25e8c641",
            "id": "IN-MAL-2026-014775",
            "modified_time": "2026-08-05T12:49:23Z",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / streak-core-insights

Package

Name
streak-core-insights
View open source insights on deps.dev
Purl
pkg:npm/streak-core-insights

Affected ranges

Affected versions

1.*
1.0.0

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "streak-core-insights-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-0a1XLz3khs096yhWeljJiTsxSvHvuHHwmNVMv/vk78WpqQYveQYBpLd8DHiYFw8NvihQdWibtqh7+EjIna6unA==",
                "sha1": "58f52320add15b0b9af65fb362dc0a4b3c2bcfec"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "index.mjs",
            "sha256": "10b0bc6972493009d8601abfd58f906655315b849f5748686bccb9b99dc91f87",
            "tlsh": "dd129482fbed27724fa483d8492cb14bea6cd4357b519894ddec52026207474f9e8bb4"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-core-insights/MAL-2026-12459.json"