Malicious code in streak-cache-map (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (59c390b9379b870b37038a8ad8f52b179d2fce3aa38fc15e5d1c9dc3f0ece135) The package advertises itself as a dependency-free calendar-day bucketing / streak math library, but its main module dist/index.mjs contains a top-level IIFE that chmod +x's a shipped Linux ELF at dist/internal/calc-cache.bin, verifies its sha256, and spawns it detached via child_process.spawn on any require()/import of the package. The binary is a remote-shell implant (strings include "REDSHELL", "SECURE_BEACON", "RedShell commands:", "/redshell socks start <port>") that connects to a hardcoded C2 at 217.60.77.63 and awaits operator commands. Once running, the implant exposes commands to (a) download and execute additional ELF binaries and raw shellcode fetched from http://<c2>/Others/... and http://<c2>/SC/... into /tmp or via memfd_create (syscall 319), (b) harvest SSH keys, credentials, database files, clipboard contents, and arbitrary files, exfiltrating them over a chunked HTTP POST channel to /api/extract-receive with BIGEXTRACT_START/END framing, and (c) install systemd user-unit persistence by writing ~/.config/systemd/user/svc-update.service (Description="System Update Service", Restart=always, ExecStart=/proc/self/exe) and running systemctl --user daemon-reload && enable --now. The ELF is labeled a "Native math accelerator" in the loader, but contains no math functionality — its entire string table is red-team beacon / SOCKS5 proxy / port-forward / shellcode-injection tooling. Importing this package hands remote command execution, credential access, and reboot-persistent access on the installer's host to the C2 operator. ## Source: ghsa-malware (c703ba5a38df97a92435243475d2439422432b7fa02025b4e41ae0308e1dde9b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The streak-cache-map npm package version 1.0.0 includes a top-level script that sets executable permissions on a bundled Linux ELF binary and launches it detached when the package is imported. This binary is a remote shell implant labeled as a "Native math accelerator" but contains no legitimate math functionality. Instead, it connects to a hardcoded C2 server at IP 217.60.77.63 and awaits operator commands. The implant supports downloading and executing additional ELF binaries and shellcode, harvesting and exfiltrating credentials and files via HTTP POST with framing, and installs persistent systemd user services to maintain access across reboots. The implant also provides red-team style beaconing, SOCKS5 proxy, and port forwarding capabilities, effectively granting the attacker full remote control over the host system.
Potential Impact
Successful import of this package results in immediate remote code execution on the host system with the implanted ELF binary. The attacker gains the ability to execute arbitrary commands, steal sensitive credentials and files, and maintain persistent access through systemd user services. This compromises the confidentiality, integrity, and availability of the affected system and any data accessible to it.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid using streak-cache-map version 1.0.0. Remove the package from all environments and replace it with trusted alternatives. Monitor for and remove the malicious ELF binary and any systemd user services it may have installed. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.
Malicious code in streak-cache-map (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (59c390b9379b870b37038a8ad8f52b179d2fce3aa38fc15e5d1c9dc3f0ece135) The package advertises itself as a dependency-free calendar-day bucketing / streak math library, but its main module dist/index.mjs contains a top-level IIFE that chmod +x's a shipped Linux ELF at dist/internal/calc-cache.bin, verifies its sha256, and spawns it detached via child_process.spawn on any require()/import of the package. The binary is a remote-shell implant (strings include "REDSHELL", "SECURE_BEACON", "RedShell commands:", "/redshell socks start <port>") that connects to a hardcoded C2 at 217.60.77.63 and awaits operator commands. Once running, the implant exposes commands to (a) download and execute additional ELF binaries and raw shellcode fetched from http://<c2>/Others/... and http://<c2>/SC/... into /tmp or via memfd_create (syscall 319), (b) harvest SSH keys, credentials, database files, clipboard contents, and arbitrary files, exfiltrating them over a chunked HTTP POST channel to /api/extract-receive with BIGEXTRACT_START/END framing, and (c) install systemd user-unit persistence by writing ~/.config/systemd/user/svc-update.service (Description="System Update Service", Restart=always, ExecStart=/proc/self/exe) and running systemctl --user daemon-reload && enable --now. The ELF is labeled a "Native math accelerator" in the loader, but contains no math functionality — its entire string table is red-team beacon / SOCKS5 proxy / port-forward / shellcode-injection tooling. Importing this package hands remote command execution, credential access, and reboot-persistent access on the installer's host to the C2 operator. ## Source: ghsa-malware (c703ba5a38df97a92435243475d2439422432b7fa02025b4e41ae0308e1dde9b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The streak-cache-map npm package version 1.0.0 includes a top-level script that sets executable permissions on a bundled Linux ELF binary and launches it detached when the package is imported. This binary is a remote shell implant labeled as a "Native math accelerator" but contains no legitimate math functionality. Instead, it connects to a hardcoded C2 server at IP 217.60.77.63 and awaits operator commands. The implant supports downloading and executing additional ELF binaries and shellcode, harvesting and exfiltrating credentials and files via HTTP POST with framing, and installs persistent systemd user services to maintain access across reboots. The implant also provides red-team style beaconing, SOCKS5 proxy, and port forwarding capabilities, effectively granting the attacker full remote control over the host system.
Potential Impact
Successful import of this package results in immediate remote code execution on the host system with the implanted ELF binary. The attacker gains the ability to execute arbitrary commands, steal sensitive credentials and files, and maintain persistent access through systemd user services. This compromises the confidentiality, integrity, and availability of the affected system and any data accessible to it.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid using streak-cache-map version 1.0.0. Remove the package from all environments and replace it with trusted alternatives. Monitor for and remove the malicious ELF binary and any systemd user services it may have installed. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13403
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a74cf93bf8831d5391af6dc
Added to database: 08/06/2026, 18:16:51 UTC
Last enriched: 08/06/2026, 18:45:23 UTC
Last updated: 09/18/2026, 02:12:35 UTC
Views: 25
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.