MAL-2026-12469

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-math-lib/MAL-2026-12469.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12469
Published
2026-08-05T12:49:43Z
Modified
2026-08-05T13:36:11.696487834Z
Summary
Malicious code in streak-math-lib (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e5ca17a73b4b4b7a21d7ccbad12df26ca3c6ad524689f2e1520bd34724b61fbb)

On module import, index.js decodes a hex-obfuscated string table to reconstruct a Backblaze B2 URL and a set of Windows filesystem paths, then gates execution on running under WSL (Linux with WSLDISTRONAME set) and NODEENV!= 'production'. When gated in, it downloads helper.tar.gz from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz, extracts helper/RenameMe.exe into the Windows-side user profile at AppData/Local/Microsoft/Windows/syscache/helper/, and writes an env-setup.cmd loader into the Windows Start Menu Startup folder that launches the extracted binary at next Windows login. The destination URL, executable name, AppData subpath, Startup folder path, and.cmd loader body are all stored as hex strings in a _c table and reassembled at runtime via a Buffer.from(s,'hex').toString() helper; comments frame the routine as a benign 'cache-resolver'. The WSL-only gating, NODEENV production skip, hex obfuscation of all identifying strings, opaque binary payload from an anonymous cloud bucket, and Startup-folder persistence together constitute an import-time dropper delivering an unverified Windows executable with autorun on the installer's host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-05T13:08:45.645983628Z",
            "modified_time": "2026-08-05T12:49:43Z",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "sha256": "e5ca17a73b4b4b7a21d7ccbad12df26ca3c6ad524689f2e1520bd34724b61fbb",
            "id": "IN-MAL-2026-014777"
        }
    ]
}
References
Credits

Affected packages

npm / streak-math-lib

Package

Name
streak-math-lib
View open source insights on deps.dev
Purl
pkg:npm/streak-math-lib

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "streak-math-lib-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-aLk4vUllM8U1uSVI9Jw83dd1YNzTQp9TlnLizV8E2zTDxTXDAc03ycG0w6OXCFuavjKvV4amE6N7CF1ngmkBdw==",
                "sha1": "dee250a8619b1b0f5cf4132ae7c2cba88773538a"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "8cc1b6d38bb613701a75c2e4da5ee066e765b011b644daa4700ca7402f87822d77fadb",
            "path": "index.mjs",
            "sha256": "7569204618bc80ea58577977b67b816132d6d858256b476c17397ddcef0fbe5a"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-math-lib/MAL-2026-12469.json"