MalwarePublished 5 Aug 2026Updated 25 Aug 2026

streak-metric-core (npm) · Malicious Code

Affects streak-metric-coreSource GCVE Database

Malicious package : remove streak-metric-core and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:15 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-12808

What to do

Remove streak-metric-core from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmstreak-metric-core	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The streak-metric-core npm package version 1.0.0 contains malicious code that executes arbitrary binaries on the host system upon import. The package reconstructs a URL at runtime to download an opaque binary from an anonymous Backblaze B2 bucket, saves it to the user's cache directory, makes it executable, and runs it detached without any integrity verification. This behavior occurs unconditionally during module load, enabling the package author to execute arbitrary code on the installer's machine.

Impact

Arbitrary code execution on the host system occurs immediately upon importing the package, allowing the attacker to run any code with the privileges of the importing user. This can lead to full system compromise, data theft, persistence, or further malicious activities. The lack of integrity checks and use of an anonymous storage location increases the risk and difficulty of detection.

Defensive guidance

Users should avoid installing or importing streak-metric-core version 1.0.0. Remove the package if already installed and scan affected systems for the presence of the downloaded binary at ~/.cache/streak-metric/service. Monitor for suspicious processes spawned from this location. Check vendor advisories or trusted security sources for updates or fixes before considering reinstallation.

Summary

The streak-metric-core package (npm ecosystem) version 1.0.0 includes malicious functionality where its main entry point reconstructs a URL from obfuscated character codes to download a binary from an anonymous Backblaze B2 storage. This binary is saved to ~/.cache/streak-metric/service, its permissions are set to executable, and it is spawned detached with a randomized delay. There is no hash or signature verification of the downloaded binary, and the URL is obfuscated to avoid detection. This results in arbitrary code execution on any host that imports the package, effectively compromising the system at import time.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 16:50 UTC

Technical details

References

Community reviews