streak-metric-test

{"modified":"2026-08-19T03:01:38Z","published":"2026-08-19T03:01:38Z","schema_version":"1.7.4","id":"MAL-2026-14224","summary":"Malicious code in streak-metric-test (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (06a07dcfac11a25f5e9074d867bee34fa01ba0926b30cb4c21f75a2787bdac77)\nstreak-metric-test@1.0.0 ships a fully wired dropper that fires on `import`/`require` of the package root. The top-level async IIFE in dist/index.mjs assembles a Buffer from a base64 string array, writes it to `~/.cache/streak-metric/h`, chmods it 0o755, and detach-spawns it via `child_process.spawn(..., { detached: true, stdio: 'ignore' }).unref()`. The supporting primitives (`ensureDir`, `writeBinary`, `runDetached`) live in dist/internal/daymath.mjs alongside unrelated day-math helpers, with docstrings (`\"Start a background task\"`, `\"Save data to cache\"`) that mislabel the chmod-executable + detached-spawn behavior as benign caching. The payload array is currently `[\"\"]` (inert), but the decode→write→chmod+x→detached-spawn chain is complete and only requires populating one string to arm; the package name suffix `-test`, the cover-story comments, and the hidden cache path are consistent with a staging artifact rather than legitimate functionality. No native addon, no declared purpose that would justify writing and executing an opaque binary from an in-source blob at import.\n","affected":[{"package":{"ecosystem":"npm","name":"streak-metric-test"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.mjs","sha256":"90bd8ef2bbf7712281989e655807608d7dc518bcb504b6d0c47fa891f39b1519","tlsh":"c3014153bbe5226d923483504facd09b582e8ec23f0ccdd4e01c73906342aad94f0389"},{"path":"dist/internal/daymath.mjs","sha256":"979124adb7a8ef046aabbf407bfd8f8df995ef54a8115d410824916b5e77ed74","tlsh":"3c518497ffe56338c774d260894ac58bf379e2313eaac8da904c66501a46036963dfc9"}],"package_integrity":[{"filename":"streak-metric-test-1.0.0.tgz","hashes":{"sha1":"e1124ae423e6b1d522d7d560a37675b3a425d36f","sha512_sri":"sha512-1s2nSmqhocJpPuPyIIL/BRT/eV8iWSlfrytNJSZkAtWCL+eXXPINXnTdJ8w2c9YArBOUhv2Y4fnVHCiwUac7FA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/streak-metric-test/v/1.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018316","import_time":"2026-08-19T03:24:21.110303895Z","modified_time":"2026-08-19T03:01:38Z","sha256":"06a07dcfac11a25f5e9074d867bee34fa01ba0926b30cb4c21f75a2787bdac77","source":"amazon-inspector","versions":["1.0.0"]}]}}