streak-metricazbd

{"modified":"2026-08-05T00:03:12Z","published":"2026-08-05T00:03:12Z","schema_version":"1.7.4","id":"MAL-2026-12001","summary":"Malicious code in streak-metricazbd (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4875da8c750beede70a9031fdd1cf1aa402c49cd94da3abbcd1964a4160a271b)\nOn import of the package, dist/index.mjs runs an IIFE that copies a bundled Linux x86_64 ELF (dist/math-core.bin) to /tmp/sm-engine-runtime/math-core.bin and spawns it via child_process.spawn, framed as 'math-core engine calibration' and wrapped in an error-swallowing try/catch. The dropped binary is a full remote-access implant identifying itself as 'RedShell': it beacons to a hardcoded remote server at 217.60.77.63, accepts commands over that channel to execute arbitrary shell commands via /bin/sh and /bin/bash, provides SOCKS5 proxying and TCP port forwarding, downloads and executes additional ELF/shellcode payloads, installs systemd --user persistence disguised as 'svc-update.service', and exposes /ssh_keys, /creds, /dbfind, /env, /dataextract, and /download commands that harvest installer SSH keys, credentials, and arbitrary files and exfiltrate them in chunks via POST /api/extract-receive. Any host that imports this package hands full remote control and credential access to the operator of 217.60.77.63.\n","affected":[{"package":{"ecosystem":"npm","name":"streak-metricazbd"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.mjs","sha256":"7a5221c06710393fc3893ef8b697bf8a2a24c63b3b8fde77433a9516127cba4d","tlsh":"36314663833e277816f88351eb3d5286063ec4633792d8a9ec5c17903902559ef79b9b"},{"path":"dist/math-core.bin","sha256":"4537b1189ce419f1a595cf47216c03f80e9170ce80dad8d9227a1e52f9cb3466","tlsh":"83531a2bbdc28e3fc084d53087dfd42269b5705aaa33712f26111f293d59a69473f72a"}],"package_integrity":[{"filename":"streak-metricazbd-1.0.0.tgz","hashes":{"sha1":"612c471cdb811b03de545f5765a46d139baf85ac","sha512_sri":"sha512-X656C3qeSmHNPqiGIfcrgOJOvXOMtXgiXJ7KuipZEFhGb04pCbiTsidihY98otvWUCUOY1lj0l0bXkZFIRrvpQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/streak-metricazbd/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011370","import_time":"2026-08-05T00:04:39.777648339Z","modified_time":"2026-08-05T00:03:12Z","sha256":"4875da8c750beede70a9031fdd1cf1aa402c49cd94da3abbcd1964a4160a271b","source":"amazon-inspector","versions":["1.0.0"]}]}}