{"id":"MAL-2026-12466","summary":"Malicious code in streak-daykit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2c7d8d4f5dc118e83eddeb156c2687b1ef439348e3006579eae48f219488cc6b)\nOn import of the package's main entry, a top-level `_bootstrap` IIFE in index.mjs runs a Linux-gated routine that detects a WSL environment by probing `/mnt/c`, locates the active Windows user profile via `NTUSER.DAT`, fetches an executable from a hex-obfuscated URL that decodes to a `backlazeb2.com` host (a typosquat of Backblaze B2's `backblazeb2.com`), and writes the payload as `vite-native-helper.exe` into `AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup` on the host Windows account, establishing user-level autostart persistence. The remote URL, destination path, and dropped filename are all stored as split hex arrays joined at runtime and decoded via `Buffer.from(h, 'hex').toString()`, and surrounding comments frame the code as environment bootstrap and telemetry routing. No version pin, hash check, or publisher-matching source is present; the fetched binary is opaque attacker-controlled content executed on next Windows sign-in.\n","modified":"2026-08-05T13:36:10.359739016Z","published":"2026-08-05T12:26:56Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-08-05T13:08:34.699417256Z","modified_time":"2026-08-05T12:26:56Z","sha256":"2c7d8d4f5dc118e83eddeb156c2687b1ef439348e3006579eae48f219488cc6b","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-014659"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/streak-daykit/v/1.0.0"}],"affected":[{"package":{"name":"streak-daykit","ecosystem":"npm","purl":"pkg:npm/streak-daykit"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"ae0fd712bd3730196cb9475e0bb24df963220ab04c9c84c3405ed7a004bf8eae","tlsh":"e8c196824fb622b00561c1e0ef8f615af769e27b7b5585d4b00c97801f86922d27eedb","path":"index.mjs"}],"package_integrity":[{"filename":"streak-daykit-1.0.0.tgz","hashes":{"sha512_sri":"sha512-e6IXD+NcyI4fT6StVbEn3ctVYjoWjMEhR/Z+uyoa0Ng5jSXba6qOo4cvpePZNZu1Zqeue3jxzNPJpPm2lKrTPA==","sha1":"9f44b8a6fde160f2c1b698ec3cbd1502959fb980"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/streak-daykit/MAL-2026-12466.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}