registry / Malware / streak-calc-metrics

streak-calc-metrics

Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for streak-calc-metrics.

This report shows the evidence for streak-calc-metrics@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The benign JavaScript math functions are a cover for an import-time execution path that launches a bundled backdoor. No lifecycle script is needed because normal import activates the payload.

Static reason

No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Any runtime import of streak-calc-metrics root entrypoint.

Impact

Remote code execution, credential/data theft, network tunneling, and persistence on the importing host.

Mechanism

import-time detached execution of a malicious bundled ELF backdoor

Attack narrative

The root module chmods and detached-spawns calc.bin during import, despite its advertised streak-math purpose. Static strings in the verified ELF expose a RedShell backdoor: remote payload retrieval and execution, shellcode/memfd execution, SOCKS and port-forwarding, credential collection, archive upload, and multiple persistence methods. This is concrete malicious behavior activated by normal package use.

AI rationale

The benign JavaScript math functions are a cover for an import-time execution path that launches a bundled backdoor. No lifecycle script is needed because normal import activates the payload.

Evidence

package.jsondist/index.mjsdist/calc.bindist/internal/daymath.mjsdist/store.mjs~/.ssh~/.config~/.bashrc

Network endpoints3

217.60.77.63api.ipify.orglitterbox.catbox.moe/resources/internals/api.php

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

dist/index.mjs executes calc.bin on every root import via detached child_process.spawn.
dist/calc.bin embeds a RedShell remote-control command set, SOCKS proxy, and TCP port forwarding.
Binary contains remote payload download, shellcode/memfd execution, and shell-command execution paths.
Binary contains SSH-key/browser-credential collection and upload commands.
Binary includes cron, bashrc, systemd, and XDG-autostart persistence routines.
Binary references C2 host 217.60.77.63 and exfiltration endpoint litterbox.catbox.moe.

Evidence against

package.json has no npm lifecycle scripts.
dist/internal/daymath.mjs contains ordinary date/streak calculations.
dist/store.mjs only implements an explicit on-disk JSON store.

Behavioral surface

Source

ChildProcessCryptoFilesystemShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 4.61 KB of source

Source & flagged code

2 flagged

dist/calc.binView file

•path = dist/calc.bin kind = native_binary sizeBytes = 63616 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/calc.binView on unpkg

dist/index.mjsView file

•matchType = malicious_source_fingerprint_signature signature = 25caf91c05abe4bd signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = streak-calc-math@1.0.0 matchedPath = dist/index.mjs matchedIdentity = npm:c3RyZWFrLWNhbGMtbWF0aA:1.0.0 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.mjsView on unpkg

Source & flagged code

2 flagged · loading source

dist/calc.binView file

•path = dist/calc.bin kind = native_binary sizeBytes = 63616 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/calc.binView on unpkg

dist/index.mjsView file

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.mjsView on unpkg

Findings

1 High1 Medium1 Low

HighKnown Malware Source Fingerprint Signaturedist/index.mjs

MediumShips Native Binarydist/calc.bin

LowFilesystem

Affected versions and remediation

This report applies to streak-calc-metrics@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing streak-calc-metrics@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-06 01:21:22.675Z (UTC).

Source advisory published: 2026-08-05 12:13:50.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.0.1-securitylatestClean—AllowPublishedAug 5, 2026, 11:50 PM 1.0.0shownMaliciousMalwareBlockPublishedAug 5, 2026, 9:02 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Behavioral surface

Source & flagged code

Related packages

Other malware packages