streak-core-insights @1.0.0
Vulnerability report · Last retrieved from osv.dev August 5, 2026 at 5:03 PM UTC
OSV ID
MAL-2026-12459
Ecosystem
npm
Summary
The package advertises calendar-day math but on module import runs an obfuscated initializer that gates on Linux + WSL_DISTRO_NAME, then downloads helper.tar.gz and a 'background-service' binary from an anonymous Backblaze B2 bucket (https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/), extracts the archive, and spawns the binary detached. The initializer then enumerates /mnt/c/Users to locate a Windows profile and writes an env-setup.cmd launcher into the Windows Startup folder (AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup) so the dropped executable auto-runs on every Windows logon, escaping the WSL sandbox. All identifiers, URLs, filesystem paths, and the.cmd template are stored as String.fromCharCode numeric arrays to defeat static inspection. The fetched binaries are unpinned, unverified, and unrelated to the stated purpose.
Source: amazon-inspector (54c92b91e60c1852de5e84952155bf8aadca8ca1a0e7e784e0e1fa4d25e8c641)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.