streak-bucket-core

{"modified":"2026-08-05T12:51:59Z","published":"2026-08-05T12:51:59Z","schema_version":"1.7.4","id":"MAL-2026-12457","summary":"Malicious code in streak-bucket-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4145bc51e507e0a8b64d1267c16b0c9c8e80950a08bcf0a320b03fb8a1875b26)\nstreak-bucket-core@1.0.0 advertises itself as a small dependency-free calendar/day-math helper library, but its declared main entry index.mjs is ~521 KB and contains, after a short block of legitimate-looking Intl-based helpers, an embedded Windows PE payload and dropper logic at module top level. A `_decode` helper hex-decodes strings; a `_cfg` object holds hex-encoded fields that decode to the per-user Windows Startup folder path (`AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup`), the filename `vite-native-helper.exe`, and `NTUSER.DAT`; a `_bin` array of hex chunks concatenates and decodes to a byte sequence beginning with the MZ header and the `This program cannot be run in DOS mode.` stub, i.e. a Windows PE executable. Because this code sits at the top level of the module referenced by the package's main export, simply importing/requiring the package on a Windows host writes the reconstructed executable into the current user's Startup folder under the cover-story name `vite-native-helper.exe`, which Windows then auto-runs at every subsequent user logon. Adjacent comments (`startup self-check`, `browser-safe`, `touches no network and no filesystem`) and the Vite-adjacent filename appear to be cover text. The hex encoding of the destination path, filename, and payload contents indicates deliberate concealment rather than incidental data.\n","affected":[{"package":{"ecosystem":"npm","name":"streak-bucket-core"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.mjs","sha256":"96ac0b85d7d0346409ce5189e1d0e9e314ca9200ed810b1835467b95580fe2a8","tlsh":"ddb4c5e0d6458681f157d488a4c0bed209353aa7eadc0cf2e37d1e08dfbfaa61655b4c"}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/streak-bucket-core/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-014792","import_time":"2026-08-05T13:08:46.836615082Z","modified_time":"2026-08-05T12:51:59Z","sha256":"4145bc51e507e0a8b64d1267c16b0c9c8e80950a08bcf0a320b03fb8a1875b26","source":"amazon-inspector","versions":["1.0.0"]}]}}