MAL-2026-12469

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-math-lib/MAL-2026-12469.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12469
Aliases
  • GHSA-h6vq-775w-5ccg
Published
2026-08-05T12:49:43Z
Modified
2026-08-26T01:14:23Z
Summary
Malicious code in streak-math-lib (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e5ca17a73b4b4b7a21d7ccbad12df26ca3c6ad524689f2e1520bd34724b61fbb)

On module import, index.js decodes a hex-obfuscated string table to reconstruct a Backblaze B2 URL and a set of Windows filesystem paths, then gates execution on running under WSL (Linux with WSL_DISTRO_NAME set) and NODE_ENV!= 'production'. When gated in, it downloads helper.tar.gz from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz, extracts helper/RenameMe.exe into the Windows-side user profile at AppData/Local/Microsoft/Windows/syscache/helper/, and writes an env-setup.cmd loader into the Windows Start Menu Startup folder that launches the extracted binary at next Windows login. The destination URL, executable name, AppData subpath, Startup folder path, and.cmd loader body are all stored as hex strings in a _c table and reassembled at runtime via a Buffer.from(s,'hex').toString() helper; comments frame the routine as a benign 'cache-resolver'. The WSL-only gating, NODE_ENV production skip, hex obfuscation of all identifying strings, opaque binary payload from an anonymous cloud bucket, and Startup-folder persistence together constitute an import-time dropper delivering an unverified Windows executable with autorun on the installer's host.

Source: ghsa-malware (6e853449d6c65e84f8a7c044a633ba268a44921bed8c197454de0a3804441cb9)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014777",
            "import_time": "2026-08-05T13:08:45.645983628Z",
            "modified_time": "2026-08-05T12:49:43Z",
            "sha256": "e5ca17a73b4b4b7a21d7ccbad12df26ca3c6ad524689f2e1520bd34724b61fbb",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "GHSA-h6vq-775w-5ccg",
            "import_time": "2026-08-25T15:30:22.801987317Z",
            "modified_time": "2026-08-25T14:50:02Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "sha256": "6e853449d6c65e84f8a7c044a633ba268a44921bed8c197454de0a3804441cb9",
            "source": "ghsa-malware"
        }
    ]
}
References
Credits

Affected packages

npm / streak-math-lib

Package

Name
streak-math-lib
View open source insights on deps.dev
Purl
pkg:npm/streak-math-lib

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "index.mjs",
            "sha256": "7569204618bc80ea58577977b67b816132d6d858256b476c17397ddcef0fbe5a",
            "tlsh": "8cc1b6d38bb613701a75c2e4da5ee066e765b011b644daa4700ca7402f87822d77fadb"
        }
    ],
    "package_integrity": [
        {
            "filename": "streak-math-lib-1.0.0.tgz",
            "hashes": {
                "sha1": "dee250a8619b1b0f5cf4132ae7c2cba88773538a",
                "sha512_sri": "sha512-aLk4vUllM8U1uSVI9Jw83dd1YNzTQp9TlnLizV8E2zTDxTXDAc03ycG0w6OXCFuavjKvV4amE6N7CF1ngmkBdw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-math-lib/MAL-2026-12469.json"