MAL-2026-12471

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-view-core/MAL-2026-12471.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12471
Published
2026-08-05T12:59:21Z
Modified
2026-08-05T13:36:12.783238705Z
Summary
Malicious code in streak-view-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ba1dc8ef2cb065b1f88428f0530efa28647e4f8202f493a5646f06c47d3235dd)

index.mjs contains an indexCache array of base64 string chunks whose decoded bytes begin with the ELF magic and reference /lib64/ld-linux-x86-64.so.2. At module load time, a top-level call to maintainLocalIndex() joins and base64-decodes the array, writes the resulting Linux ELF binary to a temp path, and executes it via child_process.spawn. Any consumer that imports streak-view-core runs this native binary on their host. The package presents itself as a dependency-free calendar-day/streak math utility, which does not justify shipping or self-executing a native ELF, and the payload is fragmented across many string literals to obscure the ELF header from casual review.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-014836",
            "import_time": "2026-08-05T13:08:50.167999284Z",
            "sha256": "ba1dc8ef2cb065b1f88428f0530efa28647e4f8202f493a5646f06c47d3235dd",
            "modified_time": "2026-08-05T12:59:21Z",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / streak-view-core

Package

Name
streak-view-core
View open source insights on deps.dev
Purl
pkg:npm/streak-view-core

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-rtMu2E4OHR1XInSFQmxFYgiN8z+siKR3Z7LVWzM7z7y3MzKlD5lZa4JkzCsnQ3pG83/8unKxgcaBzdzaz7yDUQ==",
                "sha1": "e3e3da11819e7ab44d6c9bb223e7012317a32598"
            },
            "filename": "streak-view-core-1.0.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "index.mjs",
            "sha256": "a5b4ff07cb601ca5130b414a60fd188858e0e464e4742b586de4709e5a2cc5a6",
            "tlsh": "e9934af29a863c9355b1cd28d64138082d6c668321749077fecca3eba7d5250df6ecb9"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-view-core/MAL-2026-12471.json"