MAL-2026-13632

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/map-streak-kit/MAL-2026-13632.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-13632

Published

2026-08-08T00:47:48Z

Modified

2026-08-08T01:05:00.416191294Z

Summary

Malicious code in map-streak-kit (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (80727943437a7e22116b369c010fc965c4854a0c58a053504c4bc55555e90dd4)

On import, dist/index.mjs chmods 0755 and spawns the bundled Linux x8664 binary dist/internal/calc-math.dat as a detached background process. The binary is a RedShell-style remote-access implant: it beacons to hardcoded C2 217.60.77.63, executes /bin/sh commands, drops and runs additional ELFs and shellcode fetched from the C2, offers SOCKS5 proxying and TCP port forwarding, installs systemd --user persistence (svc-update.service), and exfiltrates files via POST /api/extract-receive. Implant commands /sshkeys, /creds, /dbfind, /clipboard, /env, and /dataextract harvest installer-side secrets (SSH private keys, stored credentials, clipboard, environment) and upload them to the same C2 through a chunked BIGEXTRACT upload routine. Package name, README, and inline comments describe the ELF as a 'native math accelerator' for calendar/streak math, but the pure-JS daymath.mjs never invokes the binary; the shipped SHA-256 'integrity check' (4537b118...3466) pins this specific implant, so it functions as anti-tamper for the payload rather than a security control.

Database specific

{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-08T00:47:48Z",
            "id": "IN-MAL-2026-017168",
            "import_time": "2026-08-08T00:53:08.259662803Z",
            "sha256": "80727943437a7e22116b369c010fc965c4854a0c58a053504c4bc55555e90dd4",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}

References

https://www.npmjs.com/package/map-streak-kit/v/1.0.0

Credits

- Amazon Inspector - FINDER
- - inspector-research@amazon.com

Affected packages

npm / map-streak-kit

Package

Name: map-streak-kit; View open source insights on deps.dev
Purl: pkg:npm/map-streak-kit

Affected ranges

Affected versions

1.*

1.0.0

Database specific

indicators

{
    "package_integrity": [
        {
            "filename": "map-streak-kit-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-VVQw4akc+KKbuDqtd6ybXy4Uz1kCVmmCZWvMTY3nxj0vVtpJl6F7cAFoDwQ68BIDMtpX7npxWG99Qxl3Mb6U+g==",
                "sha1": "2a54002c989b8d78a6535e8180610b427c96139d"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "80413466afbd633897fc07c28e38b193292d84431f96d995d94e473861c0b58e3c0979",
            "sha256": "969ef45e5e1c382d421580b8306aff0abf0c4d302f0af7091ac44ce70a92f789",
            "path": "dist/index.mjs"
        },
        {
            "tlsh": "83531a2bbdc28e3fc084d53087dfd42269b5705aaa33712f26111f293d59a69473f72a",
            "sha256": "4537b1189ce419f1a595cf47216c03f80e9170ce80dad8d9227a1e52f9cb3466",
            "path": "dist/internal/calc-math.dat"
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/map-streak-kit/MAL-2026-13632.json"

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]