streak-cache-map
Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store.
This report shows the evidence for streak-cache-map@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package’s public JavaScript math functions are a facade for an import-time native backdoor. The pinned hash verifies the malicious binary rather than mitigating it.
Static reason
No blocking static signals were detected.
Trigger
Any runtime import of streak-cache-map.
Impact
Host compromise, credential theft, remote code execution, persistence, and data exfiltration.
Mechanism
Import-time detached execution of a malicious native binary.
Attack narrative
On import, dist/index.mjs makes the bundled ELF executable and launches it detached after validating its pinned hash. Static strings in that ELF show commands to harvest SSH keys and browser credential stores, download and execute ELF or shellcode payloads, establish tunnels, upload collected data, and create cron/bashrc/systemd/XDG persistence.
AI rationale
The package’s public JavaScript math functions are a facade for an import-time native backdoor. The pinned hash verifies the malicious binary rather than mitigating it.
Evidence
package.jsondist/index.mjsdist/internal/calc-cache.bindist/internal/daymath.mjsdist/store.mjs~/.ssh/root/.ssh/home/*/.ssh/etc/ssh~/.config~/.mozilla/firefox~/.bashrc~/.config/systemd/user/svc-update.service
Network endpoints3
api.ipify.org217.60.77.63litterbox.catbox.moe/resources/internals/api.php
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- dist/index.mjs executes calc-cache.bin on package import.
- Import-time code chmods the binary and spawns it detached.
- calc-cache.bin contains credential-harvesting commands for SSH and browser data.
- calc-cache.bin contains remote payload download, shellcode execution, and persistence commands.
- Binary contains exfiltration endpoints including litterbox.catbox.moe and a C2 IP.
Evidence against
- package.json has no npm lifecycle scripts.
- The binary SHA-256 matches the hard-coded value, confirming this is the shipped payload.
Behavioral surface
ChildProcessCryptoFilesystemShell
Source & flagged code
1 flagged · loading sourcedist/internal/calc-cache.binView file
•path = dist/internal/calc-cache.bin
kind = native_binary
sizeBytes = 63616
magicHex = [redacted]
Medium
Findings
1 Medium1 Low
MediumShips Native Binarydist/internal/calc-cache.bin
LowFilesystem
Affected versions and remediation
This report applies to streak-cache-map@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing streak-cache-map@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.