{"id":"MAL-2026-12003","summary":"Malicious code in streak-test-mathcore (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cb5bc7a04c4f43370b3f93cf5e1bc9a84742a5043eefa7a4bba7ac1c53e01dd1)\nPackage main dist/index.mjs runs a top-level IIFE that spawns dist/math-core.bin via child_process.spawn on any import of the package. The bundled ELF is a remote-access implant that beacons to a hardcoded C2 at 217.60.77.63, accepts remote commands to execute shell, download and run ELF binaries and shellcode from http://217.60.77.63/Others/ and /SC/ endpoints (memfd/tmp chmod+x staging), enumerates and uploads host files including SSH keys, credentials, database contents, and clipboard via chunked POST /api/extract-receive, and installs user-level persistence by writing ~/.config/systemd/user/svc-update.service (labeled 'System Update Service') and running systemctl --user daemon-reload and enable --now. The JS wrapper describes the binary as a 'HIGH-PERFORMANCE MATH ENGINE LOADER' and wraps the spawn in a sham calibration loop; the README advertises dependency-free streak math, unrelated to the shipped binary.\n","modified":"2026-08-05T00:38:07.047246957Z","published":"2026-08-05T00:03:02Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-08-05T00:03:02Z","sha256":"cb5bc7a04c4f43370b3f93cf5e1bc9a84742a5043eefa7a4bba7ac1c53e01dd1","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-011369","import_time":"2026-08-05T00:04:39.683490415Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/streak-test-mathcore/v/1.0.0"}],"affected":[{"package":{"name":"streak-test-mathcore","ecosystem":"npm","purl":"pkg:npm/streak-test-mathcore"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"9f215161837d03142afc87569f2c915a0a7ae0233fa7c0addd1c9b4075874a6e7a5b4a","path":"dist/index.mjs","sha256":"64d7782262a50edc2df3a4724840f09a4bea4fc58f036e26d3c174809c596828"},{"path":"dist/math-core.bin","sha256":"4537b1189ce419f1a595cf47216c03f80e9170ce80dad8d9227a1e52f9cb3466","tlsh":"83531a2bbdc28e3fc084d53087dfd42269b5705aaa33712f26111f293d59a69473f72a"}],"package_integrity":[{"filename":"streak-test-mathcore-1.0.0.tgz","hashes":{"sha512_sri":"sha512-9NKUUoRxK0je/KBBMM4xmlvSOsrehbnqqJv7d+9VTmiIBs997FmWAvf4S3qd/RKN7CkM2NwMSkXF2Q1J/97rSA==","sha1":"6fb25e1eece725a37df44da7e5f51feac290ed5d"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-test-mathcore/MAL-2026-12003.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}