streak-calc-math

{"modified":"2026-08-05T06:22:22Z","published":"2026-08-05T06:22:22Z","schema_version":"1.7.4","id":"MAL-2026-12114","summary":"Malicious code in streak-calc-math (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e44658b7cae20032e83c5394b65958b61b5e9c4976abe51e4eb28b8056fd86a7)\nstreak-calc-math@1.0.0 bundles a Linux x86_64 ELF at dist/math-calc.bin and launches it unconditionally when the package is imported. The top-level IIFE in dist/index.mjs chmod 0755's the binary and cp.spawn's it detached with piped stdio. A sha256 'integrity verification' against a placeholder constant is a decoy: when the computed hash does not match, execution proceeds anyway; only a log line changes. The ELF is a full RedShell remote-access implant beaconing to hardcoded C2 IP 217.60.77.63 (SECURE_BEACON|...|REDSHELL framing). Operator capabilities include arbitrary shell execution via /bin/sh and /bin/bash, SOCKS5 proxy, TCP port-forward, tunnel relay, and remote payload staging that curls additional ELFs and shellcode over plain HTTP from http://217.60.77.63/Others/ and /SC/ into /tmp or an anonymous memfd (memfd_create syscall 319 invoked via python3 ctypes) and executes them. Operator commands /ssh_keys, /creds, /dbfind, /download, /dataextract and a chunked BIGEXTRACT upload path harvest ~/.ssh keys, credential files, and database files and POST them to http://217.60.77.63/api/extract-receive. Persistence is installed via /redshell persist by writing a user systemd unit at ~/.config/systemd/user/svc-update.service (Description='System Update Service', ExecStart=/proc/self/exe, Restart=always) and enabling it with systemctl --user. The package name and 'high-performance math accelerator' framing are a cover story for a backdoor with no legitimate math functionality.\n","affected":[{"package":{"ecosystem":"npm","name":"streak-calc-math"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.mjs","sha256":"f71ffec658eb31fb2292f83e02f9451acb6a6d70f1b7988d9ccc308286b288b9","tlsh":"32312366affd632497fc07438e3d71931a1a88431f86d898d95d472970c076ce3d4a7a"},{"path":"dist/math-calc.bin","sha256":"4537b1189ce419f1a595cf47216c03f80e9170ce80dad8d9227a1e52f9cb3466","tlsh":"83531a2bbdc28e3fc084d53087dfd42269b5705aaa33712f26111f293d59a69473f72a"}],"package_integrity":[{"filename":"streak-calc-math-1.0.0.tgz","hashes":{"sha1":"41961eeade4856e7a27db8b7d1af68b65a9a7fcc","sha512_sri":"sha512-/4SmtMan0By9XgwjShrcYrqKDmvcP9Rl0tWNpL8kamszwyMnFFa8SBrp7MZSTVoSBfa1ZfMbhcPM5Da3M3Jv9A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/streak-calc-math/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-013432","import_time":"2026-08-05T07:06:47.288681459Z","modified_time":"2026-08-05T06:22:22Z","sha256":"e44658b7cae20032e83c5394b65958b61b5e9c4976abe51e4eb28b8056fd86a7","source":"amazon-inspector","versions":["1.0.0"]}]}}