{"id":"MAL-2026-11150","summary":"Malicious code in streak-daily-lib (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8664341251bd6864f5aaf9692c5b7bd0945125853bc304c91709aaa335be38f1)\nOn import of index.mjs, setImmediate invokes a _syncWorkspace routine whose network destination and paths are reconstructed at runtime from hex-encoded string arrays (a _cfg object decoded via Buffer.from(s,'hex').toString()). The decoded host is f004.backblazeb2.com and the path prefix is /file/dp8hbvocjd2fpza/. Execution is gated on Linux with WSL_DISTRO_NAME set. The code downloads helper.tar.gz and a background-service binary via https.get, writes them to disk, extracts the tarball with `tar -xzf`, chmods the service to 0755, and launches it detached with.unref(). It then reaches through the WSL /mnt/c mount into the Windows host filesystem, drops vite.exe under %APPDATA%\\Local\\Microsoft\\Windows\\syscache, and writes env-setup.cmd into %APPDATA%\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ containing `start /b /min \"\" \"[BIN]\"` so the fetched Windows binary runs minimized on every login. The stated purpose of the package is calendar/streak math; none of the fetched hosts, opaque binaries, hex-obfuscated identifiers, or Windows Startup writes align with that purpose. Combined signals present: import-time auto-execution, hex-obfuscated attacker-controlled host, unpinned/unverified binary download and execute, WSL-to-Windows-host escape, and login persistence.\n","modified":"2026-07-28T14:37:13.312590226Z","published":"2026-07-28T13:34:25Z","database_specific":{"malicious-packages-origins":[{"sha256":"8664341251bd6864f5aaf9692c5b7bd0945125853bc304c91709aaa335be38f1","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-010906","import_time":"2026-07-28T14:19:58.47070009Z","modified_time":"2026-07-28T13:34:25Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/streak-daily-lib/v/1.0.0"}],"affected":[{"package":{"name":"streak-daily-lib","ecosystem":"npm","purl":"pkg:npm/streak-daily-lib"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"streak-daily-lib-1.0.0.tgz","hashes":{"sha1":"7db7d1a116631bcb362f7715d37d0f0a6aed8e87","sha512_sri":"sha512-xaTiQk/qCOK2aTF/0jZcp3/6QwIS7eevc3HIC+nW0QTLE3PedKBCYMEPyrG0FFGQNfmhnreivzTggHQxmB6/8Q=="}}],"evidence_files":[{"tlsh":"0bc124a141bb52344372c2d06b6ff11a6d16e2073584c9c5be4ca7409f8bf31edb6ae8","path":"index.mjs","sha256":"2687e5106275f581847fa6ba26a1849ca4c0f42ff448ce85765fc6d10a3f8bcc"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-daily-lib/MAL-2026-11150.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}