{"id":"MAL-2026-12047","summary":"Malicious code in streak-day-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (478c2375c5f06dfa7595d312a43145eb929e1cf536d7ad960716159268582e4d)\nindex.mjs schedules an asynchronous routine at module load that decodes a table of hex-encoded strings to reconstruct references to process, fetch, child_process, /mnt/c, AppData, a Backblaze B2 URL, RenameMe.exe, and a VBScript body invoking WScript.Shell.Run hidden. When Node executes under WSL (detected via /mnt/c), the code enumerates Windows user profiles under /mnt/c/Users, downloads helper.tar.gz from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz, extracts it into the victim's AppData\\Local\\Microsoft\\Windows\\syscache directory, and writes vite-native-helper.vbs into the Windows Startup folder to auto-launch the extracted RenameMe.exe on every login. The behavior is presented under a 'vite-cache-sync' cover story, and all filesystem paths, the remote URL, and the VBScript payload are hex-obfuscated to conceal the dropper. Installing or importing this package causes cross-boundary WSL-to-Windows code execution and establishes persistence on the Windows host controlled by the package author.\n","modified":"2026-08-05T01:49:54.728633459Z","published":"2026-08-05T01:04:31Z","database_specific":{"malicious-packages-origins":[{"versions":["1.0.0"],"id":"IN-MAL-2026-011484","import_time":"2026-08-05T01:39:31.027367533Z","modified_time":"2026-08-05T01:04:31Z","sha256":"478c2375c5f06dfa7595d312a43145eb929e1cf536d7ad960716159268582e4d","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/streak-day-utils/v/1.0.0"}],"affected":[{"package":{"name":"streak-day-utils","ecosystem":"npm","purl":"pkg:npm/streak-day-utils"},"versions":["1.0.0"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"index.mjs","sha256":"ee1fbee7f9e6fdb42922afb84d719874bbeaf99fe74cfbc752e2c18271072085","tlsh":"28e1d8c28ff313311d69d2a29bcf944ae325b16276c2d994b00cd7482f46564e3bd69e"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-day-utils/MAL-2026-12047.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}