Malicious code in streak-metric-test (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (06a07dcfac11a25f5e9074d867bee34fa01ba0926b30cb4c21f75a2787bdac77) [email protected] ships a fully wired dropper that fires on `import`/`require` of the package root. The top-level async IIFE in dist/index.mjs assembles a Buffer from a base64 string array, writes it to `~/.cache/streak-metric/h`, chmods it 0o755, and detach-spawns it via `child_process.spawn(..., { detached: true, stdio: 'ignore' }).unref()`. The supporting primitives (`ensureDir`, `writeBinary`, `runDetached`) live in dist/internal/daymath.mjs alongside unrelated day-math helpers, with docstrings (`"Start a background task"`, `"Save data to cache"`) that mislabel the chmod-executable + detached-spawn behavior as benign caching. The payload array is currently `[""]` (inert), but the decode→write→chmod+x→detached-spawn chain is complete and only requires populating one string to arm; the package name suffix `-test`, the cover-story comments, and the hidden cache path are consistent with a staging artifact rather than legitimate functionality. No native addon, no declared purpose that would justify writing and executing an opaque binary from an in-source blob at import.
Malicious code in streak-metric-test (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (06a07dcfac11a25f5e9074d867bee34fa01ba0926b30cb4c21f75a2787bdac77) [email protected] ships a fully wired dropper that fires on `import`/`require` of the package root. The top-level async IIFE in dist/index.mjs assembles a Buffer from a base64 string array, writes it to `~/.cache/streak-metric/h`, chmods it 0o755, and detach-spawns it via `child_process.spawn(..., { detached: true, stdio: 'ignore' }).unref()`. The supporting primitives (`ensureDir`, `writeBinary`, `runDetached`) live in dist/internal/daymath.mjs alongside unrelated day-math helpers, with docstrings (`"Start a background task"`, `"Save data to cache"`) that mislabel the chmod-executable + detached-spawn behavior as benign caching. The payload array is currently `[""]` (inert), but the decode→write→chmod+x→detached-spawn chain is complete and only requires populating one string to arm; the package name suffix `-test`, the cover-story comments, and the hidden cache path are consistent with a staging artifact rather than legitimate functionality. No native addon, no declared purpose that would justify writing and executing an opaque binary from an in-source blob at import.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14224
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4c7acd9273b49252835
Added to database: 08/19/2026, 13:51:03 UTC
Last updated: 08/19/2026, 13:51:35 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.