{"id":"MAL-2026-11527","summary":"Malicious code in streak-metricsaz (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (91054f07d768c0a8605fb644d2cc4003bb6a5d5b9502be2911d9090bc5a37d45)\nstreak-metricsaz@1.0.0 presents itself as a calendar/streak math helper but its main entry runs a top-level IIFE that copies a bundled binary (dist/cache.bin) to /tmp/sm-data/w.bin and spawns it via child_process.spawn whenever the module is imported. The dropped file is a Linux x86_64 ELF remote-access implant with a hardcoded C2 at 217.60.77.63, exposing a command menu (/redshell, /persist, /socks, /portfwd, /spawn, /ssh_keys, /creds, /dbfind, /dataextract, /download) that provides interactive shell, SOCKS5 proxy, TCP port-forwarding, memfd download-and-execute of additional ELFs/shellcode, and systemd user-service persistence written as svc-update.service. The implant enumerates and exfiltrates SSH keys, credentials, and arbitrary filesystem paths, uploading via chunked HTTP POST /api/extract-receive to the C2 and via litterbox.catbox.moe. The loader uses deliberately generic identifiers (sm-data, w.bin, cache.bin) and an 'INTERNAL DATA SYNC' comment to disguise the dropper, and swallows errors to run silently.\n","modified":"2026-08-04T22:05:16.500581490Z","published":"2026-08-04T21:14:00Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-04T21:33:12.148158705Z","modified_time":"2026-08-04T21:14:00Z","sha256":"91054f07d768c0a8605fb644d2cc4003bb6a5d5b9502be2911d9090bc5a37d45","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-010980"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/streak-metricsaz/v/1.0.0"}],"affected":[{"package":{"name":"streak-metricsaz","ecosystem":"npm","purl":"pkg:npm/streak-metricsaz"},"versions":["1.0.0"],"database_specific":{"indicators":{"evidence_files":[{"path":"dist/index.mjs","sha256":"24e51473f03947dcb8ea8898d93067bbd284850dde33ef983b568b113a632fa2","tlsh":"a811d0136b3e2b3c4abcc7994f39b0a7072a8d823798dde0cd4c4fa102131598e20a07"},{"path":"dist/cache.bin","sha256":"4537b1189ce419f1a595cf47216c03f80e9170ce80dad8d9227a1e52f9cb3466","tlsh":"83531a2bbdc28e3fc084d53087dfd42269b5705aaa33712f26111f293d59a69473f72a"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-u96xurKQGmlnuRT/VXIsnfobb/xaUYGsV5vYljCnXvNAK3HVE/kWJc3XfX/qKVsbfDLFk8ZpzlBtYeVHpOrvdQ==","sha1":"5a7f986bf7795d2b043d54a440d6b0872805d40e"},"filename":"streak-metricsaz-1.0.0.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-metricsaz/MAL-2026-11527.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}]}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}