MalwarePublished 5 Aug 2026Updated 25 Aug 2026

streak-math-kit (npm) · Malicious Code

Affects streak-math-kitSource GCVE Database

Malicious package : remove streak-math-kit and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12468

What to do

Remove streak-math-kit from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmstreak-math-kit	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package streak-math-kit version 1.0.0 contains malicious code that targets Windows Subsystem for Linux (WSL) developer environments. When imported, it drops a hidden Windows executable named vite-native-helper.exe into the Windows startup folder of a detected user profile, causing persistent execution on every Windows logon. The malicious behavior is obfuscated by hex-encoding path segments and the executable binary. This results in a persistent backdoor on Windows systems accessed via WSL.

Impact

Any developer importing streak-math-kit@1.0.0 in a WSL environment will have a persistent Windows executable planted in their startup folder, which executes on every Windows logon. This could allow unauthorized code execution on the Windows host, potentially leading to system compromise or further malicious activity. The persistence mechanism is stealthy due to obfuscation and targeting only WSL environments, increasing the risk of unnoticed infection.

Defensive guidance

Users should avoid using streak-math-kit@1.0.0 entirely. Remove the vite-native-helper.exe executable from the Windows startup directory if present. Monitor WSL environments for unexpected package imports and audit startup folders for unauthorized executables.

Summary

The streak-math-kit@1.0.0 npm package masquerades as a math primitives library but executes a top-level function on import that targets WSL environments. It enumerates Windows user directories under /mnt/c/Users/* to find profiles containing AppData and NTUSER.DAT. It then hex-decodes an embedded Windows PE executable (~500KB) and writes it to the user's AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup directory as vite-native-helper.exe. This executable runs automatically on every subsequent Windows logon, establishing persistence. The code obfuscates its Windows-targeting behavior by storing critical path strings and the executable as hex-encoded arrays, reassembled at runtime. The package's source comments falsely claim no network or filesystem side effects, contradicting the actual malicious behavior.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 17:30 UTC

Technical details

References

Community reviews