MAL-2026-14222

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-cal-core/MAL-2026-14222.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14222
Published
2026-08-19T03:02:12Z
Modified
2026-08-19T03:30:19.755132596Z
Summary
Malicious code in streak-cal-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a4e42ea741c3a61878fa72cd8b7ab4547c52f14b69f429129c46edba70771287)

index.mjs (the package's main entry) contains a ~500 KB base64-encoded x86-64 ELF payload stored in a _store array disguised with a // --- Calibration Data --- comment. On import, the module joins the base64 chunks, writes the decoded bytes to disk with mode 0o755, dynamically imports node:child_process, and executes the dropped binary. The behavior fires as a top-level import side effect, so any consumer that requires or imports the package runs the embedded native code. The file's header comment labels the module streak-larq-hydration and references svelte-insight-hydration, while the package is published as streak-cal-core with a README pointing at svelte-streak-cal — internal naming does not match the published identity, consistent with a family of sibling typosquat variants. The advertised purpose (dependency-free calendar/streak math helper) is inconsistent with shipping and executing an opaque native binary.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T03:24:21.434150257Z",
            "sha256": "a4e42ea741c3a61878fa72cd8b7ab4547c52f14b69f429129c46edba70771287",
            "modified_time": "2026-08-19T03:02:12Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018318",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / streak-cal-core

Package

Name
streak-cal-core
View open source insights on deps.dev
Purl
pkg:npm/streak-cal-core

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-cal-core/MAL-2026-14222.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "a5da13f458cbed1b19212126bda6fd69dceb4cfdc84ed3a38c7374a11dd788d0",
            "tlsh": "ddb402f196867ce795b5cd28f4092d081e68178310f9a12fb8d832e757e6390ab6fc74",
            "path": "index.mjs"
        }
    ],
    "package_integrity": [
        {
            "filename": "streak-cal-core-1.0.0.tgz",
            "hashes": {
                "sha1": "87250c266b63657a6e17ee28cba456045bc19bdb",
                "sha512_sri": "sha512-9FYBYjra0mx+xwO8kOUwpOSZGs8En5nZl8WWpBJwuPCfaYzQjauMPlfMqfq1OuFuasH1OV4FVrcdrUwnoMXiEg=="
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]