MAL-2026-12467

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-int-lib/MAL-2026-12467.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12467
Published
2026-08-05T12:31:12Z
Modified
2026-08-05T13:36:10.728191231Z
Summary
Malicious code in streak-int-lib (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0acd9bdc8d6474a54b3c985b8472cd50295130d12029de1a8a10175f9be8bb35)

streak-int-lib@1.0.0 ships an x86-64 ELF binary as a base64 blob disguised as configuration data (defaultConfig.data joined into embeddedService in index.mjs). On module import, top-level code invokes initializeBackgroundService(), which decodes the blob, writes it to ~/.config/systemd/user/index with mode 0755, and spawns it via childprocess.spawn with detached:true, stdio ignored, and proc.unref() so the native process outlives Node. The decoded binary contains TLS/networking symbols (SSLwrite, SSLconnect, TLSclient_method, getaddrinfo, gethostname, setsid), indicating a network-capable backgrounded payload. Cover-story comments describe the side effect as a benign 'startup self-check' that 'touches no network and no filesystem', contradicting the observed behavior. The package's declared calendar-math purpose has no need for a bundled ELF or a systemd-path persistence artifact.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-014688",
            "import_time": "2026-08-05T13:08:37.663209819Z",
            "versions": [
                "1.0.0"
            ],
            "modified_time": "2026-08-05T12:31:12Z",
            "sha256": "0acd9bdc8d6474a54b3c985b8472cd50295130d12029de1a8a10175f9be8bb35"
        }
    ]
}
References
Credits

Affected packages

npm / streak-int-lib

Package

Name
streak-int-lib
View open source insights on deps.dev
Purl
pkg:npm/streak-int-lib

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-int-lib/MAL-2026-12467.json"
indicators 
{
    "evidence_files": [
        {
            "tlsh": "24935af696873c92a5b11c68d64638082d6c65432139c06afecc63ebb7e5160cf6ecf5",
            "sha256": "7161fea1d7017f8ee2824550283cc6f4551a42d75f9da3c730bc90808df61831",
            "path": "index.mjs"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "93dc678e84a7b80b0f6d2726582ec802632803f9",
                "sha512_sri": "sha512-3GCXV+4UBMcqHbrxjpl6Kk2miMrzdURXQvh6VV44ImrvMqKSAtBo8g1abW6jAbXohI1W3rJYhsLtXuWZ6sSaWg=="
            },
            "filename": "streak-int-lib-1.0.0.tgz"
        }
    ]
}