lib-streak-math
Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for svelte-streak-lib.
This report shows the evidence for lib-streak-math@1.0.0, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe import-time obfuscated installer creates a concrete remote-payload and persistence chain. Absence of an npm lifecycle hook does not mitigate execution when consumers import the default entrypoint.
Static reason
No blocking static signals were detected.
Trigger
Runtime import of index.mjs.
Impact
Arbitrary attacker-controlled code can execute persistently for the logged-in Windows user.
Mechanism
Obfuscated remote payload download, Startup-folder persistence, and detached process launch.
Attack narrative
On module import, index.mjs decodes hidden strings, identifies a Windows user profile, downloads an archive and executable from Backblaze B2, extracts the archive, starts the executable detached, and writes a command file to the user Startup directory. This is covert remote code execution and persistence, unrelated to streak math.
AI rationale
The import-time obfuscated installer creates a concrete remote-payload and persistence chain. Absence of an npm lifecycle hook does not mitigate execution when consumers import the default entrypoint.
Evidence
package.jsonindex.mjsstore.mjsREADME.md/mnt/c/Users/<user>/AppData/Local/Microsoft/Windows/syscache/helper.tar.gz/mnt/c/Users/<user>/AppData/Local/Microsoft/Windows/syscache/helper/vite.exe/mnt/c/Users/<user>/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/background-service/mnt/c/Users/<user>/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/env-setup.cmd
Network endpoints2
f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gzf004.backblazeb2.com/file/dp8hbvocjd2fpza/background-service
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.mjs import-time async payload uses obfuscated dynamic imports of fs, path, and child_process.
- It enumerates /mnt/c/Users and environment variables to select a Windows user profile.
- It downloads helper.tar.gz and background-service from f004.backblazeb2.com.
- It extracts a payload, launches it detached, and writes env-setup.cmd into the Windows Startup folder.
Evidence against
- package.json has no npm lifecycle scripts.
- The documented streak functions and store.mjs are otherwise local-only utilities.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
1 flagged · loading sourceindex.mjsView file
90(async () => {
L91: const _fs = await import(_D([113,138,94,123,137,158,120,128,162,112,138]));
L92: const _p = await import(_D([123,120,163,115]));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
index.mjsView on unpkg · L90Findings
2 Medium1 Low
MediumDynamic Requireindex.mjs
MediumEnvironment Vars
LowFilesystem
Affected versions and remediation
This report applies to lib-streak-math@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing lib-streak-math@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.