MalwarePublished 5 Aug 2026

calendar-streak-core (npm) · Malicious Code

Affects calendar-streak-coreSource GCVE Database

Malicious package : remove calendar-streak-core and rotate any secrets on hosts that installed it.

Data as of 5 Aug 2026, 17:49 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12345

What to do

Remove calendar-streak-core from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcalendar-streak-core	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package calendar-streak-core@1.0.0 contains embedded malicious code that drops a Windows executable into the user's Startup folder, enabling persistent execution on Windows logon. The package falsely claims to be dependency-free and harmless, but it embeds a hex-encoded Windows PE executable that is decoded and written to %AppData%/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe. This behavior occurs immediately upon module import, allowing any project importing this package on Windows to gain persistent execution of the embedded binary.

Impact

Any Windows system that imports calendar-streak-core@1.0.0 will have a malicious executable silently dropped into the user's Startup folder, resulting in persistent execution of this binary at every logon. This compromises system integrity and can lead to unauthorized code execution without user consent or awareness. The persistence mechanism leverages the per-user Startup folder, making it effective for maintaining foothold on infected machines.

Defensive guidance

Users and developers should immediately remove this package from their projects and dependency trees, especially on Windows systems. Avoid installing or importing this package. Monitor and remove the file %AppData%/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe if present. Check all dependent projects for indirect usage of this malicious package.

Summary

The calendar-streak-core package version 1.0.0 for npm is advertised as a simple calendar-day and streak math library without dependencies. However, its index.mjs file contains a hex-encoded Windows PE executable embedded as a string array, along with a hex-encoded destination path that resolves to a per-user Startup folder location. Upon import, the module decodes and writes this executable to the Startup folder, ensuring it runs on every Windows logon. This behavior contradicts the in-code comments claiming no network or filesystem interaction. The large size (~500KB) of the package is dominated by the embedded executable, which is inconsistent with its advertised functionality. This results in silent persistent execution of malicious code on Windows systems that import this package directly or transitively.

References

npmjs.com/package/calendar-streak-core/v/1.0.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 17:49 UTC

Technical details

References

Community reviews