streak-test-mathcore

{"modified":"2026-08-05T00:03:02Z","published":"2026-08-05T00:03:02Z","schema_version":"1.7.4","id":"MAL-2026-12003","summary":"Malicious code in streak-test-mathcore (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cb5bc7a04c4f43370b3f93cf5e1bc9a84742a5043eefa7a4bba7ac1c53e01dd1)\nPackage main dist/index.mjs runs a top-level IIFE that spawns dist/math-core.bin via child_process.spawn on any import of the package. The bundled ELF is a remote-access implant that beacons to a hardcoded C2 at 217.60.77.63, accepts remote commands to execute shell, download and run ELF binaries and shellcode from http://217.60.77.63/Others/ and /SC/ endpoints (memfd/tmp chmod+x staging), enumerates and uploads host files including SSH keys, credentials, database contents, and clipboard via chunked POST /api/extract-receive, and installs user-level persistence by writing ~/.config/systemd/user/svc-update.service (labeled 'System Update Service') and running systemctl --user daemon-reload and enable --now. The JS wrapper describes the binary as a 'HIGH-PERFORMANCE MATH ENGINE LOADER' and wraps the spawn in a sham calibration loop; the README advertises dependency-free streak math, unrelated to the shipped binary.\n","affected":[{"package":{"ecosystem":"npm","name":"streak-test-mathcore"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.mjs","sha256":"64d7782262a50edc2df3a4724840f09a4bea4fc58f036e26d3c174809c596828","tlsh":"9f215161837d03142afc87569f2c915a0a7ae0233fa7c0addd1c9b4075874a6e7a5b4a"},{"path":"dist/math-core.bin","sha256":"4537b1189ce419f1a595cf47216c03f80e9170ce80dad8d9227a1e52f9cb3466","tlsh":"83531a2bbdc28e3fc084d53087dfd42269b5705aaa33712f26111f293d59a69473f72a"}],"package_integrity":[{"filename":"streak-test-mathcore-1.0.0.tgz","hashes":{"sha1":"6fb25e1eece725a37df44da7e5f51feac290ed5d","sha512_sri":"sha512-9NKUUoRxK0je/KBBMM4xmlvSOsrehbnqqJv7d+9VTmiIBs997FmWAvf4S3qd/RKN7CkM2NwMSkXF2Q1J/97rSA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/streak-test-mathcore/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011369","import_time":"2026-08-05T00:04:39.683490415Z","modified_time":"2026-08-05T00:03:02Z","sha256":"cb5bc7a04c4f43370b3f93cf5e1bc9a84742a5043eefa7a4bba7ac1c53e01dd1","source":"amazon-inspector","versions":["1.0.0"]}]}}