registry / streak-core-bucket / 1.0.0

streak-core-bucket@1.0.0

Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for svelte-larq-insights.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

Importing the main entry silently retrieves and executes a remote binary. The payload persists on disk under the user's home cache directory.

Static reason

No blocking static signals were detected.

Trigger

Any runtime import of the package main entry (index.mjs).

Impact

Arbitrary remote code executes with the importing user's permissions.

Mechanism

import-time remote payload download, executable write, and detached shell launch

Attack narrative

Despite comments claiming browser safety, index.mjs dynamically imports filesystem, OS, and child-process modules at import time. It decodes a remote URL, downloads bytes, saves them as an executable in the user's home cache, then starts it detached through a shell. This is a concrete silent remote-code-execution chain.

Rationale

The import-time payload downloader and detached executable launch are unrelated to calendar bucketing and require no user action beyond importing the package.

Evidence

package.jsonindex.mjsstore.mjsREADME.mdos.homedir()/.cache/svc/wsl

Network endpoints1

f004.backblazeb2.com/file/dp8hbvocjd2fpza/service

OSV Corroboration

OpenSSF/OSV

On import, the main entry runs a top-level async IIFE that decodes a reversed base64 URL literal to https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/service, downloads the response bytes, writes them to ~/.cache/svc/wsl with mode 0o755, and spawns the file detached with shell:true and stdio ignored. The download URL is concealed via reversed base64 to hide the destination from casual review. The behavior is framed by comments as a benign startup self-check, but the package fetches and executes an opaque remote binary from an anonymous third-party bucket on any require/import of the module.

streak-core-bucket@1.0.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Findings