Malicious code in streak-key-lib (npm)
The streak-key-lib npm package version 1.0.0 contains malicious code disguised as a dependency-free, browser-safe day-math helper. Despite claiming no network or filesystem interaction, it includes a large obfuscated block that executes on import, using an RC4/XOR decoder and self-defense techniques to evade analysis. The package is designed as a supply-chain stager, executing hidden code at import time and misleading consumers by promoting companion packages instead of direct installation. This behavior poses a risk of unauthorized code execution in Node.js environments that import this package.
AI Analysis
Technical Summary
The streak-key-lib package (npm ecosystem) version 1.0.0 advertises itself as a simple math helper with no side effects but contains a ~65KB obfuscated payload at the module's top level. This payload includes a base64-encoded string array and an RC4/XOR decoder function, along with anti-debugging regexes to prevent code beautification and analysis. The malicious code executes immediately upon require/import, contrary to the package's stated purpose. The package header also misleads users by referencing different package names and encouraging installation of companion packages, indicating a supply-chain attack vector designed to execute hidden code within parent Node.js applications.
Potential Impact
Importing or requiring streak-key-lib version 1.0.0 in a Node.js environment results in execution of obfuscated malicious code, potentially enabling unauthorized actions within the host process. The package's deceptive appearance and import-time execution increase the risk of supply-chain compromise and hidden code execution in applications that transitively depend on it.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing or importing streak-key-lib version 1.0.0. Review dependency trees for indirect usage of this package and remove or replace it with trusted alternatives. Monitor vendor advisories for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Malicious code in streak-key-lib (npm)
Description
The streak-key-lib npm package version 1.0.0 contains malicious code disguised as a dependency-free, browser-safe day-math helper. Despite claiming no network or filesystem interaction, it includes a large obfuscated block that executes on import, using an RC4/XOR decoder and self-defense techniques to evade analysis. The package is designed as a supply-chain stager, executing hidden code at import time and misleading consumers by promoting companion packages instead of direct installation. This behavior poses a risk of unauthorized code execution in Node.js environments that import this package.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The streak-key-lib package (npm ecosystem) version 1.0.0 advertises itself as a simple math helper with no side effects but contains a ~65KB obfuscated payload at the module's top level. This payload includes a base64-encoded string array and an RC4/XOR decoder function, along with anti-debugging regexes to prevent code beautification and analysis. The malicious code executes immediately upon require/import, contrary to the package's stated purpose. The package header also misleads users by referencing different package names and encouraging installation of companion packages, indicating a supply-chain attack vector designed to execute hidden code within parent Node.js applications.
Potential Impact
Importing or requiring streak-key-lib version 1.0.0 in a Node.js environment results in execution of obfuscated malicious code, potentially enabling unauthorized actions within the host process. The package's deceptive appearance and import-time execution increase the risk of supply-chain compromise and hidden code execution in applications that transitively depend on it.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing or importing streak-key-lib version 1.0.0. Review dependency trees for indirect usage of this package and remove or replace it with trusted alternatives. Monitor vendor advisories for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14223
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4c7acd9273b49252833
Added to database: 08/19/2026, 13:51:03 UTC
Last enriched: 08/19/2026, 14:38:05 UTC
Last updated: 08/19/2026, 14:38:05 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.