streak-calc-math
Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for streak-calc-math.
This report shows the evidence for streak-calc-math@1.0.0, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe math API is a thin JavaScript façade, while import-time execution launches a bundled backdoor unrelated to its stated purpose. This is concrete malicious behavior, not a benign native accelerator.
Static reason
No blocking static signals were detected.
Trigger
Any runtime import of streak-calc-math.
Impact
Credential and data theft, remote code execution, network proxying, and host persistence.
Mechanism
Import-time detached execution of a bundled backdoor binary.
Attack narrative
A normal package import runs an async initializer that changes the bundled ELF's permissions and starts it detached. Static binary strings show a RedShell-style backdoor with SSH and browser credential collection, archive upload exfiltration, payload download/execution, SOCKS and port forwarding, and cron/bashrc/systemd/XDG persistence.
AI rationale
The math API is a thin JavaScript façade, while import-time execution launches a bundled backdoor unrelated to its stated purpose. This is concrete malicious behavior, not a benign native accelerator.
Evidence
package.jsondist/index.mjsdist/math-calc.bindist/internal/daymath.mjs~/.ssh/root/.ssh/etc/ssh~/.config/systemd/user/svc-update.service~/.bashrc
Network endpoints3
217.60.77.63litterbox.catbox.moe/resources/internals/api.phpapi.ipify.org
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- dist/index.mjs executes math-calc.bin on root import.
- The binary is chmodded executable and spawned detached.
- Binary strings expose SSH/browser credential collection.
- Binary includes upload exfiltration to litterbox.catbox.moe.
- Binary supports remote payload download, shellcode, and persistence.
Evidence against
- package.json has no lifecycle scripts.
- dist/internal/daymath.mjs contains ordinary date helpers.
Behavioral surface
ChildProcessCryptoFilesystemShell
Source & flagged code
1 flagged · loading sourcedist/math-calc.binView file
•path = dist/math-calc.bin
kind = native_binary
sizeBytes = 63616
magicHex = [redacted]
Medium
Findings
1 Medium1 Low
MediumShips Native Binarydist/math-calc.bin
LowFilesystem
Affected versions and remediation
This report applies to streak-calc-math@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing streak-calc-math@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.