MAL-2026-12467
Malicious code in streak-int-lib (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (0acd9bdc8d6474a54b3c985b8472cd50295130d12029de1a8a10175f9be8bb35) streak-int-lib@1.0.0 ships an x86-64 ELF binary as a base64 blob disguised as configuration data (defaultConfig.data joined into embeddedService in index.mjs). On module import, top-level code invokes initializeBackgroundService(), which decodes the blob, writes it to ~/.config/systemd/user/index with mode 0755, and spawns it via child_process.spawn with detached:true, stdio ignored, and proc.unref() so the native process outlives Node. The decoded binary contains TLS/networking symbols (SSL_write, SSL_connect, TLS_client_method, getaddrinfo, gethostname, setsid), indicating a network-capable backgrounded payload. Cover-story comments describe the side effect as a benign 'startup self-check' that 'touches no network and no filesystem', contradicting the observed behavior. The package's declared calendar-math purpose has no need for a bundled ELF or a systemd-path persistence artifact.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for streak-int-lib (npm). Pin to a known-safe version or switch to an alternative.