MAL-2026-12462

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-day-engine/MAL-2026-12462.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12462
Published
2026-08-05T12:29:17Z
Modified
2026-08-05T13:36:08.352660166Z
Summary
Malicious code in streak-day-engine (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (fb1b5dba41de915e2ef23790e3e92b3839b9a52e5196480d12ae8a7a8208cf82)

index.mjs runs a hex-obfuscated top-level async IIFE at module import time. Identifiers and payload constants (process, fetch, child_process, fs/promises, target paths, URL, tar command, VBS template) are stored hex-encoded in a _c table and decoded via Buffer.from(h, 'hex').toString(). On import, the code fetches https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz, writes the archive under the user's AppData directory, extracts it via tar -xzf, and writes a VBS launcher (vite-native-helper.vbs) into AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup that uses CreateObject("WScript.Shell").Run p, 0, False to invoke the extracted RenameMe.exe hidden at every user login. Result: attacker-controlled bytes land on the installer's host on import/require of the package, and a login-persistent execution channel is established via the Windows Startup folder.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T12:29:17Z",
            "sha256": "fb1b5dba41de915e2ef23790e3e92b3839b9a52e5196480d12ae8a7a8208cf82",
            "id": "IN-MAL-2026-014675",
            "versions": [
                "1.0.0"
            ],
            "import_time": "2026-08-05T13:08:36.160076975Z"
        }
    ]
}
References
Credits

Affected packages

npm / streak-day-engine

Package

Name
streak-day-engine
View open source insights on deps.dev
Purl
pkg:npm/streak-day-engine

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.mjs",
            "sha256": "7a667f151f1f52f3e1e08641fa357ffac75ba78e675577e86f49aaa85546e684",
            "tlsh": "07d1d7865bf353b00968d2a686db424ed319b052b6c9c998b00cdb443f4a610f3be98f"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-day-engine/MAL-2026-12462.json"