MAL-2026-12807

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-grid-core/MAL-2026-12807.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-12807
Published
2026-08-05T13:11:20Z
Modified
2026-08-05T14:37:23.155410701Z
Summary
Malicious code in streak-grid-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b40df62bf7b6dcc3bc33d5b2b876ea57e4f355dd326f48ec7a6d3750fa6148d7)

The package advertises itself as dependency-free calendar/streak math primitives, but the main entry (index.mjs, resolved via package.json exports ".") contains a top-level 'Background sync' block that concatenates a large array of base64 chunks (each beginning with the ELF magic marker 'f0VMRg' = \x7fELF), decodes the result with Buffer.from(..., 'base64'), writes it to disk with mode 0o755, and executes it via a dynamically imported node:child_process. Any consumer that imports this module (including transitively via svelte-streak-grid referenced in the README) triggers native code execution on the installer/build host. The payload is split across multiple quoted string chunks and joined at runtime to evade simple string scanners, and file header comments reference unrelated package names ('streak-larq-hydration', 'svelte-insight-hydration') that do not match the published name, consistent with cover-story framing.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-05T13:11:20Z",
            "id": "IN-MAL-2026-014917",
            "import_time": "2026-08-05T14:19:42.804863001Z",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector",
            "sha256": "b40df62bf7b6dcc3bc33d5b2b876ea57e4f355dd326f48ec7a6d3750fa6148d7"
        }
    ]
}
References
Credits

Affected packages

npm / streak-grid-core

Package

Name
streak-grid-core
View open source insights on deps.dev
Purl
pkg:npm/streak-grid-core

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "streak-grid-core-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-J1671fMCVc8qYSFjvuB64ujRamLK8IwnZ+B9ccuK/6WrdlA/JyUDxVL7BNXgmgy6JCmwz2r1qd88V0o0GzdBYQ==",
                "sha1": "1144a5c65ecb47a297051f09fb9673e253c4f254"
            }
        }
    ],
    "evidence_files": [
        {
            "path": "index.mjs",
            "tlsh": "6b934bb296863c9299b10cacd14e38c82d6c668321749267fecc53ebe3d5150ef5ecb5",
            "sha256": "328b194f9d255ed4a07bd241364822aa36fcbe4211afa324e7cd3e2c1f9a809e"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-grid-core/MAL-2026-12807.json"