MAL-2026-14224
Dashboard / Malicious Package / MAL-2026-14224
MAL-2026-14224
Summary: Malicious code in streak-metric-test (npm)
Details: Source: amazon-inspector (06a07dcfac11a25f5e9074d867bee34fa01ba0926b30cb4c21f75a2787bdac77) [email protected] ships a fully wired dropper that fires on `import`/`require` of the package root. The top-level async IIFE in dist/index.mjs assembles a Buffer from a base64 string array, writes it to `~/.cache/streak-metric/h`, chmods it 0o755, and detach-spawns it via `child_process.spawn(..., { detached: true, stdio: 'ignore' }).unref()`. The supporting primitives (`ensureDir`, `writeBinary`, `runDetached`) live in dist/internal/daymath.mjs alongside unrelated day-math helpers, with docstrings (`"Start a background task"`, `"Save data to cache"`) that mislabel the chmod-executable + detached-spawn behavior as benign caching. The payload array is currently `[""]` (inert), but the decode→write→chmod+x→detached-spawn chain is complete and only requires populating one string to arm; the package name suffix `-test`, the cover-story comments, and the hidden cache path are consistent with a staging artifact rather than legitimate functionality. No native addon, no declared purpose that would justify writing and executing an opaque binary from an in-source blob at import.
Affected packages
Package
Name: streak-metric-test
Purl: pkg:npm/streak-metric-test
Affected ranges
Type: N/A
Events:
