registry / Remote code execution / streak-core-bucket
streak-core-bucket
Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for svelte-larq-insights.
This report shows the evidence for streak-core-bucket@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe import-time payload downloader and detached executable launch are unrelated to calendar bucketing and require no user action beyond importing the package.
Static reason
No blocking static signals were detected.
Trigger
Any runtime import of the package main entry (index.mjs).
Impact
Arbitrary remote code executes with the importing user's permissions.
Mechanism
import-time remote payload download, executable write, and detached shell launch
Attack narrative
Despite comments claiming browser safety, index.mjs dynamically imports filesystem, OS, and child-process modules at import time. It decodes a remote URL, downloads bytes, saves them as an executable in the user's home cache, then starts it detached through a shell. This is a concrete silent remote-code-execution chain.
AI rationale
The import-time payload downloader and detached executable launch are unrelated to calendar bucketing and require no user action beyond importing the package.
Evidence
package.jsonindex.mjsstore.mjsREADME.mdos.homedir()/.cache/svc/wsl
Network endpoints1
f004.backblazeb2.com/file/dp8hbvocjd2fpza/service
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.mjs runs an async IIFE on every import.
- It downloads a payload from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/service.
- It writes the download as an executable at os.homedir()/.cache/svc/wsl.
- It launches that executable detached with shell:true via child_process.spawn.
Evidence against
- package.json has no npm lifecycle scripts.
- store.mjs is a bounded JSON temp-directory store with no network use.
Behavioral surface
FilesystemNetwork
HighEntropyStrings
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
4 High1 Medium2 Low
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
MediumNetwork
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to streak-core-bucket@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing streak-core-bucket@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.