streak-cal-core

{"modified":"2026-08-19T03:02:12Z","published":"2026-08-19T03:02:12Z","schema_version":"1.7.4","id":"MAL-2026-14222","summary":"Malicious code in streak-cal-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (a4e42ea741c3a61878fa72cd8b7ab4547c52f14b69f429129c46edba70771287)\nindex.mjs (the package's main entry) contains a ~500 KB base64-encoded x86-64 ELF payload stored in a `_store` array disguised with a `// --- Calibration Data ---` comment. On import, the module joins the base64 chunks, writes the decoded bytes to disk with mode 0o755, dynamically imports `node:child_process`, and executes the dropped binary. The behavior fires as a top-level import side effect, so any consumer that `require`s or `import`s the package runs the embedded native code. The file's header comment labels the module `streak-larq-hydration` and references `svelte-insight-hydration`, while the package is published as `streak-cal-core` with a README pointing at `svelte-streak-cal` — internal naming does not match the published identity, consistent with a family of sibling typosquat variants. The advertised purpose (dependency-free calendar/streak math helper) is inconsistent with shipping and executing an opaque native binary.\n","affected":[{"package":{"ecosystem":"npm","name":"streak-cal-core"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.mjs","sha256":"a5da13f458cbed1b19212126bda6fd69dceb4cfdc84ed3a38c7374a11dd788d0","tlsh":"ddb402f196867ce795b5cd28f4092d081e68178310f9a12fb8d832e757e6390ab6fc74"}],"package_integrity":[{"filename":"streak-cal-core-1.0.0.tgz","hashes":{"sha1":"87250c266b63657a6e17ee28cba456045bc19bdb","sha512_sri":"sha512-9FYBYjra0mx+xwO8kOUwpOSZGs8En5nZl8WWpBJwuPCfaYzQjauMPlfMqfq1OuFuasH1OV4FVrcdrUwnoMXiEg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/streak-cal-core/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018318","import_time":"2026-08-19T03:24:21.434150257Z","modified_time":"2026-08-19T03:02:12Z","sha256":"a4e42ea741c3a61878fa72cd8b7ab4547c52f14b69f429129c46edba70771287","source":"amazon-inspector","versions":["1.0.0"]}]}}