MAL-2026-14224

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-metric-test/MAL-2026-14224.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14224
Published
2026-08-19T03:01:38Z
Modified
2026-08-19T03:30:16Z
Summary
Malicious code in streak-metric-test (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (06a07dcfac11a25f5e9074d867bee34fa01ba0926b30cb4c21f75a2787bdac77)

streak-metric-test@1.0.0 ships a fully wired dropper that fires on import/require of the package root. The top-level async IIFE in dist/index.mjs assembles a Buffer from a base64 string array, writes it to ~/.cache/streak-metric/h, chmods it 0o755, and detach-spawns it via child_process.spawn(..., { detached: true, stdio: 'ignore' }).unref(). The supporting primitives (ensureDir, writeBinary, runDetached) live in dist/internal/daymath.mjs alongside unrelated day-math helpers, with docstrings ("Start a background task", "Save data to cache") that mislabel the chmod-executable + detached-spawn behavior as benign caching. The payload array is currently [""] (inert), but the decode→write→chmod+x→detached-spawn chain is complete and only requires populating one string to arm; the package name suffix -test, the cover-story comments, and the hidden cache path are consistent with a staging artifact rather than legitimate functionality. No native addon, no declared purpose that would justify writing and executing an opaque binary from an in-source blob at import.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018316",
            "import_time": "2026-08-19T03:24:21.110303895Z",
            "modified_time": "2026-08-19T03:01:38Z",
            "sha256": "06a07dcfac11a25f5e9074d867bee34fa01ba0926b30cb4c21f75a2787bdac77",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / streak-metric-test

Package

Name
streak-metric-test
View open source insights on deps.dev
Purl
pkg:npm/streak-metric-test

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "dist/index.mjs",
            "sha256": "90bd8ef2bbf7712281989e655807608d7dc518bcb504b6d0c47fa891f39b1519",
            "tlsh": "c3014153bbe5226d923483504facd09b582e8ec23f0ccdd4e01c73906342aad94f0389"
        },
        {
            "path": "dist/internal/daymath.mjs",
            "sha256": "979124adb7a8ef046aabbf407bfd8f8df995ef54a8115d410824916b5e77ed74",
            "tlsh": "3c518497ffe56338c774d260894ac58bf379e2313eaac8da904c66501a46036963dfc9"
        }
    ],
    "package_integrity": [
        {
            "filename": "streak-metric-test-1.0.0.tgz",
            "hashes": {
                "sha1": "e1124ae423e6b1d522d7d560a37675b3a425d36f",
                "sha512_sri": "sha512-1s2nSmqhocJpPuPyIIL/BRT/eV8iWSlfrytNJSZkAtWCL+eXXPINXnTdJ8w2c9YArBOUhv2Y4fnVHCiwUac7FA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-metric-test/MAL-2026-14224.json"