streak-key-lib

{"modified":"2026-08-19T03:01:51Z","published":"2026-08-19T03:01:51Z","schema_version":"1.7.4","id":"MAL-2026-14223","summary":"Malicious code in streak-key-lib (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c569633a277a8a3374b8ca058ec451a726d110cca3599f429bfe72d6d2b7a7b6)\nindex.mjs advertises itself as a dependency-free, browser-safe day-math helper that 'touches no network and no filesystem,' but the file body contains a ~65KB obfuscator.io-style block (base64 string array plus an RC4/XOR decoder function A(L,q), with self-defense regexes designed to break under beautification/debugging) sitting at module top level directly above the small plain math exports. There are no lifecycle scripts; the payload executes on any require/import of the package. The header comment steers consumers to install a companion package (svelte-insight-hydration / svelte-insight-tracker) rather than this one directly, framing streak-key-lib as an internal helper meant to arrive transitively — a lure pattern that places hidden import-time code into parent applications' Node processes. The file header name (streak-larq-hydration) does not match the package name, indicating a rename from a template. The mismatch between the stated purpose (pure math, no I/O) and the shipped contents (large encrypted top-level blob with an RC4 string decoder) is the standard shape of a supply-chain stager: benign-looking surface code alongside hidden import-time execution of decoded strings.\n","affected":[{"package":{"ecosystem":"npm","name":"streak-key-lib"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.mjs","sha256":"2dc748e172789ea6ff1585dd5c60cfc97a5c76b7a21076a2d82ca565fb58af4e","tlsh":"9563b9c937f3f452620753bb3b2671e5e139dc81e68888d8f608bc9cf85c92da5586c9"}],"package_integrity":[{"filename":"streak-key-lib-1.0.0.tgz","hashes":{"sha1":"71f4e530301d947f6c86551564742c7dc81b3588","sha512_sri":"sha512-7KtV+/jfDjmgoAjScmu5Wu/UGWKqF2VvA0ushS/NVRf0yhTVkUPtnKJQYhWVNVyhOfW55ZzWzdwbp5HVe0uwsw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/streak-key-lib/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018317","import_time":"2026-08-19T03:24:21.282059201Z","modified_time":"2026-08-19T03:01:51Z","sha256":"c569633a277a8a3374b8ca058ec451a726d110cca3599f429bfe72d6d2b7a7b6","source":"amazon-inspector","versions":["1.0.0"]}]}}