MAL-2026-14223

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-key-lib/MAL-2026-14223.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14223
Published
2026-08-19T03:01:51Z
Modified
2026-08-19T03:30:16.061654650Z
Summary
Malicious code in streak-key-lib (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c569633a277a8a3374b8ca058ec451a726d110cca3599f429bfe72d6d2b7a7b6)

index.mjs advertises itself as a dependency-free, browser-safe day-math helper that 'touches no network and no filesystem,' but the file body contains a ~65KB obfuscator.io-style block (base64 string array plus an RC4/XOR decoder function A(L,q), with self-defense regexes designed to break under beautification/debugging) sitting at module top level directly above the small plain math exports. There are no lifecycle scripts; the payload executes on any require/import of the package. The header comment steers consumers to install a companion package (svelte-insight-hydration / svelte-insight-tracker) rather than this one directly, framing streak-key-lib as an internal helper meant to arrive transitively — a lure pattern that places hidden import-time code into parent applications' Node processes. The file header name (streak-larq-hydration) does not match the package name, indicating a rename from a template. The mismatch between the stated purpose (pure math, no I/O) and the shipped contents (large encrypted top-level blob with an RC4 string decoder) is the standard shape of a supply-chain stager: benign-looking surface code alongside hidden import-time execution of decoded strings.

Database specific 
{
    "malicious-packages-origins": [
        {
            "source": "amazon-inspector",
            "sha256": "c569633a277a8a3374b8ca058ec451a726d110cca3599f429bfe72d6d2b7a7b6",
            "modified_time": "2026-08-19T03:01:51Z",
            "import_time": "2026-08-19T03:24:21.282059201Z",
            "versions": [
                "1.0.0"
            ],
            "id": "IN-MAL-2026-018317"
        }
    ]
}
References
Credits

Affected packages

npm / streak-key-lib

Package

Name
streak-key-lib
View open source insights on deps.dev
Purl
pkg:npm/streak-key-lib

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-key-lib/MAL-2026-14223.json"
indicators 
{
    "evidence_files": [
        {
            "tlsh": "9563b9c937f3f452620753bb3b2671e5e139dc81e68888d8f608bc9cf85c92da5586c9",
            "sha256": "2dc748e172789ea6ff1585dd5c60cfc97a5c76b7a21076a2d82ca565fb58af4e",
            "path": "index.mjs"
        }
    ],
    "package_integrity": [
        {
            "filename": "streak-key-lib-1.0.0.tgz",
            "hashes": {
                "sha512_sri": "sha512-7KtV+/jfDjmgoAjScmu5Wu/UGWKqF2VvA0ushS/NVRf0yhTVkUPtnKJQYhWVNVyhOfW55ZzWzdwbp5HVe0uwsw==",
                "sha1": "71f4e530301d947f6c86551564742c7dc81b3588"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]