MAL-2026-12463

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-day-primitives/MAL-2026-12463.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12463
Published
2026-08-05T12:48:41Z
Modified
2026-08-05T13:36:09.011081689Z
Summary
Malicious code in streak-day-primitives (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2c4f0cfff000aa550229c0148bf96c70335e4d37048fa9f8fda3d4391ea2249b)

The package advertises itself as dependency-free calendar-day arithmetic, but index.mjs contains top-level code that runs on import. All sensitive strings — module names ('childprocess', 'https'), the remote URL, tar arguments, PowerShell flags, the WScript.Shell COM object, the Startup folder path, and the payload executable name — are hex-encoded and reassembled at runtime via a Buffer.from(s,'hex').toString() helper (_d + _k table) to hide the payload from static review. When the host is Linux with WSLDISTRO_NAME set and /mnt/c is reachable, the code fetches a tarball from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz, extracts it into the Windows user's AppData tree, and uses PowerShell (-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass) plus WScript.Shell CreateShortcut to drop a.lnk pointing at the extracted RenameMe.exe into the Windows user's Startup folder. This is a WSL-to-Windows escape that grants the attacker code execution on the installer's Windows host at next login, with no relation to the package's stated purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "2c4f0cfff000aa550229c0148bf96c70335e4d37048fa9f8fda3d4391ea2249b",
            "modified_time": "2026-08-05T12:48:41Z",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014770",
            "import_time": "2026-08-05T13:08:45.135746957Z"
        }
    ]
}
References
Credits

Affected packages

npm / streak-day-primitives

Package

Name
streak-day-primitives
View open source insights on deps.dev
Purl
pkg:npm/streak-day-primitives

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-day-primitives/MAL-2026-12463.json"
indicators 
{
    "evidence_files": [
        {
            "path": "index.mjs",
            "sha256": "73ae738211bc59d8f56d2a098528d2c82cab5a831e04e898edea01b7734134be",
            "tlsh": "85d1c8d2dbb253702675c2e5d7cfa056bb1670027680dea4740c93852f8a861d2be9e6"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "72bdb93280859071b4e6ea90180e2f587ed37e1c",
                "sha512_sri": "sha512-nqdFvDXjEpk3n3FI/VpbZjF4hQn2elS051a1MgitPhQ4mnS++aBa37ZsNXKo4qCdYA2zkmT6X4PJ7HiQiTmbng=="
            },
            "filename": "streak-day-primitives-1.0.0.tgz"
        }
    ]
}