MalwarePublished 5 Aug 2026Updated 25 Aug 2026

streak-core-bucket (npm) · Malicious Code

Affects streak-core-bucketSource GCVE Database

Malicious package : remove streak-core-bucket and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12806

What to do

Remove streak-core-bucket from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmstreak-core-bucket	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The streak-core-bucket npm package version 1.0.0 contains malicious code that, upon import, downloads and executes a remote binary from an obfuscated URL. This behavior is disguised as a benign startup check but actually fetches an opaque executable from an anonymous third-party source and runs it with elevated permissions.

Impact

Any system that imports or requires the streak-core-bucket package version 1.0.0 will execute a remote binary from an untrusted source without user consent or verification. This can lead to arbitrary code execution, potentially compromising system integrity, confidentiality, and availability. The malicious binary is opaque, and its exact payload is unknown from the provided data, but the execution of remote code inherently poses a high security risk.

Defensive guidance

Users should immediately avoid using streak-core-bucket version 1.0.0 and remove it from their projects. Since the package executes remote code on import, it should be considered untrusted and blocked from use. Monitor for updates from the package maintainer or npm advisories for any official fixes or removals. Until then, do not import or require this package in any environment.

Summary

The streak-core-bucket npm package (version 1.0.0) includes a top-level asynchronous immediately-invoked function expression (IIFE) that decodes a reversed base64 string to reveal a URL pointing to a third-party storage bucket. Upon import, it downloads the binary from this URL, writes it to a local cache directory with executable permissions (0o755), and spawns the binary detached from the parent process, ignoring standard input/output streams. The download URL is deliberately obfuscated to evade casual detection. This behavior is framed misleadingly as a benign self-check but effectively executes arbitrary remote code on any require or import of the package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 17:10 UTC

Technical details

References

Community reviews