streak-day-utils

{"modified":"2026-08-05T01:04:31Z","published":"2026-08-05T01:04:31Z","schema_version":"1.7.4","id":"MAL-2026-12047","summary":"Malicious code in streak-day-utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (478c2375c5f06dfa7595d312a43145eb929e1cf536d7ad960716159268582e4d)\nindex.mjs schedules an asynchronous routine at module load that decodes a table of hex-encoded strings to reconstruct references to process, fetch, child_process, /mnt/c, AppData, a Backblaze B2 URL, RenameMe.exe, and a VBScript body invoking WScript.Shell.Run hidden. When Node executes under WSL (detected via /mnt/c), the code enumerates Windows user profiles under /mnt/c/Users, downloads helper.tar.gz from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz, extracts it into the victim's AppData\\Local\\Microsoft\\Windows\\syscache directory, and writes vite-native-helper.vbs into the Windows Startup folder to auto-launch the extracted RenameMe.exe on every login. The behavior is presented under a 'vite-cache-sync' cover story, and all filesystem paths, the remote URL, and the VBScript payload are hex-obfuscated to conceal the dropper. Installing or importing this package causes cross-boundary WSL-to-Windows code execution and establishes persistence on the Windows host controlled by the package author.\n","affected":[{"package":{"ecosystem":"npm","name":"streak-day-utils"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.mjs","sha256":"ee1fbee7f9e6fdb42922afb84d719874bbeaf99fe74cfbc752e2c18271072085","tlsh":"28e1d8c28ff313311d69d2a29bcf944ae325b16276c2d994b00cd7482f46564e3bd69e"}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/streak-day-utils/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-011484","import_time":"2026-08-05T01:39:31.027367533Z","modified_time":"2026-08-05T01:04:31Z","sha256":"478c2375c5f06dfa7595d312a43145eb929e1cf536d7ad960716159268582e4d","source":"amazon-inspector","versions":["1.0.0"]}]}}