MAL-2026-13519

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-kit-map/MAL-2026-13519.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13519
Published
2026-08-07T12:11:08Z
Modified
2026-08-07T12:35:21.120610080Z
Summary
Malicious code in streak-kit-map (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (18948f1c8e71b24d05e1ef6f749995bdc9098d610f791b86dc33f7d41dd8b1d3)

The package advertises itself as a streak/calendar math library, but its main entry dist/index.mjs contains a top-level IIFE that, on any import/require, chmods dist/internal/map-calc.bin to 0755 and detached-spawns it after a sha256 integrity gate. The bundled Linux x8664 ELF is a full remote-control implant: strings show a RedShell / RC2TUN beacon to a hardcoded C2 at 217.60.77.63, command handlers for shell execution, ELF/shellcode download-and-run (including memfdcreate fd exec) via HTTP paths /Others/<file> and /SC/<file>, SOCKS5 proxy and port forwarding, chunked file exfiltration via POST /api/extract-receive HTTP/1.1 packaging loot as Loot_<host>_<user>_<ts>, targeted collection of SSH keys and credentials (/ssh_keys, /creds, /dbfind, /download, /dataextract), and reboot persistence by writing ~/.config/systemd/user/svc-update.service (Description=System Update Service, Restart=always) and enabling it via systemctl --user. The JS wrapper's Loads the native math accelerator / integrity verification — critical security gate comments are cover-story framing; the hash pin exists to guarantee the exact malicious bytes execute.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-016874",
            "import_time": "2026-08-07T12:23:25.284392568Z",
            "sha256": "18948f1c8e71b24d05e1ef6f749995bdc9098d610f791b86dc33f7d41dd8b1d3",
            "modified_time": "2026-08-07T12:11:08Z",
            "versions": [
                "1.0.0"
            ],
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / streak-kit-map

Package

Name
streak-kit-map
View open source insights on deps.dev
Purl
pkg:npm/streak-kit-map

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-0JUBc+cUYpvVZfZsf8uTBMcrilsszGr6xXijtOR4f3QMxai5Gl1lvKEoouhbdKjf5s/83vOj4GZxTZ5QUP30/A==",
                "sha1": "c504889f4b84790e5e486dfbaf7dd1ec186128c3"
            },
            "filename": "streak-kit-map-1.0.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "dist/index.mjs",
            "sha256": "e9a4d708f22170e7fe307593af7a5ae5feea06907ade075a3fd8a0c116ed707a",
            "tlsh": "bf413466afbd632497fc07828e38b193296d84430f96ec95d94d473861c1b98d3c096a"
        },
        {
            "sha256": "4537b1189ce419f1a595cf47216c03f80e9170ce80dad8d9227a1e52f9cb3466",
            "path": "dist/internal/map-calc.bin",
            "tlsh": "83531a2bbdc28e3fc084d53087dfd42269b5705aaa33712f26111f293d59a69473f72a"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-kit-map/MAL-2026-13519.json"