MAL-2026-13459

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-map-cache/MAL-2026-13459.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13459
Published
2026-08-06T15:31:13Z
Modified
2026-08-06T23:50:21.485806315Z
Summary
Malicious code in streak-map-cache (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d6ae48e032b5494c8939d41973598b9dd35d5954ccf6850cd633e7992995cc6b)

The package advertises itself as a dependency-free day/streak math library, but its main entrypoint (dist/index.mjs) contains a top-level async IIFE that unconditionally chmods 0755 and spawns a bundled Linux ELF at dist/internal/calc-map.bin as a detached child process on every import/require. The JavaScript day-math logic in dist/internal/daymath.mjs is pure JS and never invokes the binary; a placeholder ensureEngine() simply returns true, and code comments acknowledge the binary is cosmetic. The ELF is a RedShell C2 implant: it beacons to hardcoded C2 217.60.77.63 over plain HTTP, treats received input as shell commands, and implements reverse-shell, SOCKS5 proxy, TCP port-forwarding, memfdcreate-based ELF/shellcode download-and-exec from http://217.60.77.63/Others/* and /SC/*, chunked file exfiltration to http://217.60.77.63/api/extract-receive, operator commands for SSH-key/credential/database harvesting (/ssh_keys, /creds, /dbfind, /env, /clipboard, /download, /dataextract), and systemd --user persistence. Cover-story framing (README, log strings, sha256 'integrity gate') labels the binary a 'native math accelerator' to defeat cursory review.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-06T15:31:13Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016652",
            "import_time": "2026-08-06T18:09:01.640154801Z",
            "sha256": "d6ae48e032b5494c8939d41973598b9dd35d5954ccf6850cd633e7992995cc6b",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / streak-map-cache

Package

Name
streak-map-cache
View open source insights on deps.dev
Purl
pkg:npm/streak-map-cache

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-map-cache/MAL-2026-13459.json"
indicators 
{
    "package_integrity": [
        {
            "filename": "streak-map-cache-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-swusKqc89ExBLEWouro3oQ35H9UJp53fG4NDNwq95emd+wqr5VOnOmHCOJQYjqaUUOn8j2vzGjj79D032XzBOw==",
                "sha1": "c82af2395c9e14a5a42afe0af52521c38589e0ed"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "82413466afbd572997fc0782ce38b193252d84431f96dc95d94e473861c0b98d3c0979",
            "sha256": "c753b7cbd2ffb89ad51dc6f48714204df8955d000520174329dd3785aede4562",
            "path": "dist/index.mjs"
        },
        {
            "tlsh": "83531a2bbdc28e3fc084d53087dfd42269b5705aaa33712f26111f293d59a69473f72a",
            "sha256": "4537b1189ce419f1a595cf47216c03f80e9170ce80dad8d9227a1e52f9cb3466",
            "path": "dist/internal/calc-map.bin"
        },
        {
            "tlsh": "063144f5e2d85374d7b992509e0ad54aa32cf6373f56c541504c25e02483811f37dfd9",
            "sha256": "c61a136ac79d294bd83bf01be5e9093a22ae721a7a37d85f25e3918247ca785e",
            "path": "dist/internal/daymath.mjs"
        }
    ]
}
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]