MAL-2026-12462
Malicious code in streak-day-engine (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (fb1b5dba41de915e2ef23790e3e92b3839b9a52e5196480d12ae8a7a8208cf82) index.mjs runs a hex-obfuscated top-level async IIFE at module import time. Identifiers and payload constants (`process`, `fetch`, `child_process`, `fs/promises`, target paths, URL, tar command, VBS template) are stored hex-encoded in a `_c` table and decoded via `Buffer.from(h, 'hex').toString()`. On import, the code fetches https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz, writes the archive under the user's AppData directory, extracts it via `tar -xzf`, and writes a VBS launcher (`vite-native-helper.vbs`) into `AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup` that uses `CreateObject("WScript.Shell").Run p, 0, False` to invoke the extracted `RenameMe.exe` hidden at every user login. Result: attacker-controlled bytes land on the installer's host on `import`/`require` of the package, and a login-persistent execution channel is established via the Windows Startup folder.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for streak-day-engine (npm). Pin to a known-safe version or switch to an alternative.