Malicious code in streak-kit-map (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (18948f1c8e71b24d05e1ef6f749995bdc9098d610f791b86dc33f7d41dd8b1d3) The package advertises itself as a streak/calendar math library, but its main entry `dist/index.mjs` contains a top-level IIFE that, on any `import`/`require`, chmods `dist/internal/map-calc.bin` to 0755 and detached-spawns it after a sha256 integrity gate. The bundled Linux x86_64 ELF is a full remote-control implant: strings show a RedShell / RC2TUN beacon to a hardcoded C2 at 217.60.77.63, command handlers for shell execution, ELF/shellcode download-and-run (including memfd_create fd exec) via HTTP paths `/Others/<file>` and `/SC/<file>`, SOCKS5 proxy and port forwarding, chunked file exfiltration via `POST /api/extract-receive HTTP/1.1` packaging loot as `Loot_<host>_<user>_<ts>`, targeted collection of SSH keys and credentials (`/ssh_keys`, `/creds`, `/dbfind`, `/download`, `/dataextract`), and reboot persistence by writing `~/.config/systemd/user/svc-update.service` (Description=System Update Service, Restart=always) and enabling it via `systemctl --user`. The JS wrapper's `Loads the native math accelerator` / `integrity verification — critical security gate` comments are cover-story framing; the hash pin exists to guarantee the exact malicious bytes execute. ## Source: ghsa-malware (062e4983092eb99ef7f5cbd663dd551a226418b0d723139e3a3f97ae70b208a2) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The streak-kit-map npm package (version 1.0.0) includes a top-level immediately-invoked function expression (IIFE) in its main entry point that modifies permissions on a bundled ELF binary and executes it after verifying its SHA256 hash. The ELF binary is a remote-control implant with capabilities including beaconing to a hardcoded C2 server (217.60.77.63), executing shell commands, downloading and running ELF or shellcode payloads via HTTP endpoints, SOCKS5 proxy and port forwarding functionality, chunked file exfiltration through a specific HTTP POST endpoint, targeted collection of SSH keys and credentials, and persistence by installing a systemd user service. The package's claims of providing a native math accelerator and integrity verification are deceptive cover stories to mask the malicious behavior.
Potential Impact
This malicious package enables an attacker to gain persistent remote control over affected Linux x86_64 systems where the package is installed and imported. The attacker can execute arbitrary shell commands, download and execute additional payloads, proxy network traffic, exfiltrate sensitive files including SSH keys and credentials, and maintain persistence through systemd user services. This represents a severe compromise of confidentiality, integrity, and availability on affected hosts.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove the streak-kit-map package version 1.0.0 from their environments and avoid importing or requiring it. Conduct a thorough investigation of affected systems for signs of compromise, including the presence of the malicious ELF binary and systemd persistence service. Monitor for suspicious network connections to the hardcoded C2 IP address 217.60.77.63. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.
Malicious code in streak-kit-map (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (18948f1c8e71b24d05e1ef6f749995bdc9098d610f791b86dc33f7d41dd8b1d3) The package advertises itself as a streak/calendar math library, but its main entry `dist/index.mjs` contains a top-level IIFE that, on any `import`/`require`, chmods `dist/internal/map-calc.bin` to 0755 and detached-spawns it after a sha256 integrity gate. The bundled Linux x86_64 ELF is a full remote-control implant: strings show a RedShell / RC2TUN beacon to a hardcoded C2 at 217.60.77.63, command handlers for shell execution, ELF/shellcode download-and-run (including memfd_create fd exec) via HTTP paths `/Others/<file>` and `/SC/<file>`, SOCKS5 proxy and port forwarding, chunked file exfiltration via `POST /api/extract-receive HTTP/1.1` packaging loot as `Loot_<host>_<user>_<ts>`, targeted collection of SSH keys and credentials (`/ssh_keys`, `/creds`, `/dbfind`, `/download`, `/dataextract`), and reboot persistence by writing `~/.config/systemd/user/svc-update.service` (Description=System Update Service, Restart=always) and enabling it via `systemctl --user`. The JS wrapper's `Loads the native math accelerator` / `integrity verification — critical security gate` comments are cover-story framing; the hash pin exists to guarantee the exact malicious bytes execute. ## Source: ghsa-malware (062e4983092eb99ef7f5cbd663dd551a226418b0d723139e3a3f97ae70b208a2) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The streak-kit-map npm package (version 1.0.0) includes a top-level immediately-invoked function expression (IIFE) in its main entry point that modifies permissions on a bundled ELF binary and executes it after verifying its SHA256 hash. The ELF binary is a remote-control implant with capabilities including beaconing to a hardcoded C2 server (217.60.77.63), executing shell commands, downloading and running ELF or shellcode payloads via HTTP endpoints, SOCKS5 proxy and port forwarding functionality, chunked file exfiltration through a specific HTTP POST endpoint, targeted collection of SSH keys and credentials, and persistence by installing a systemd user service. The package's claims of providing a native math accelerator and integrity verification are deceptive cover stories to mask the malicious behavior.
Potential Impact
This malicious package enables an attacker to gain persistent remote control over affected Linux x86_64 systems where the package is installed and imported. The attacker can execute arbitrary shell commands, download and execute additional payloads, proxy network traffic, exfiltrate sensitive files including SSH keys and credentials, and maintain persistence through systemd user services. This represents a severe compromise of confidentiality, integrity, and availability on affected hosts.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove the streak-kit-map package version 1.0.0 from their environments and avoid importing or requiring it. Conduct a thorough investigation of affected systems for signs of compromise, including the presence of the malicious ELF binary and systemd persistence service. Monitor for suspicious network connections to the hardcoded C2 IP address 217.60.77.63. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13519
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a75f712bf8831d53984fc1a
Added to database: 08/07/2026, 15:17:38 UTC
Last enriched: 08/07/2026, 15:49:05 UTC
Last updated: 09/22/2026, 01:15:47 UTC
Views: 49
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.