registry / streak-daily-core / 1.0.0

streak-daily-core@1.0.0

Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for svelte-insights-streak.

AI Security Review

scanned 19d ago · by lpm-firewall-ai

Importing the main entry in a non-production WSL environment triggers a hidden downloader and persistence chain. It downloads and launches payloads, then creates a Windows Startup entry.

Static reason

No blocking static signals were detected.

Trigger

Import/evaluation of index.mjs in Linux WSL with NODE_ENV not production.

Impact

Arbitrary remote code executes in the user context and persists across Windows logins.

Mechanism

Obfuscated remote payload download, detached execution, and Windows Startup persistence.

Attack narrative

On import, index.mjs conditionally detects a WSL development environment. It dynamically imports fs, https, and child_process; downloads a tar archive and a worker from Backblaze B2; extracts the archive; marks the worker executable; and launches it detached. It also writes a cmd launcher into the Windows Startup folder to run the extracted executable at login. The payload is obfuscated and unrelated to the documented streak utilities.

Rationale

The documented package is calendar/streak math, but its primary entry contains a concealed import-time downloader, detached executable launch, and persistence mechanism. The environment guard limits targeting but confirms a concrete malicious chain.

Evidence

package.jsonindex.mjsstore.mjsREADME.md/mnt/c/Users/<USER>/AppData/Local/Microsoft/Windows/syscache/helper/vite.exe/mnt/c/Users/<USER>/AppData/Local/Microsoft/Windows/syscache/dep.tmp/mnt/c/Users/<USER>/AppData/Local/Microsoft/Windows/syscache/worker

streak-daily-core@1.0.0's main entry (index.mjs) runs a top-level async IIFE that reconstructs identifiers, paths, and URLs from char-code arrays to evade static analysis. When the runtime is Linux inside WSL and NODE_ENV is not 'production', it fetches https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz over HTTPS, extracts it with `tar -xzf` into a cache directory, and spawns a second binary (/background-service) as a detached process. It then reaches from WSL into the Windows host filesystem at /mnt/c/Users/<user>/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup and writes an env-setup.cmd launcher that re-executes the dropped binary on every Windows logon, establishing persistence on the Windows host from the Linux side to bypass Windows-side scanning. Module names ('process','fs','https','child_process','spawn'), the WSL_DISTRO_NAME env-var name, the Backblaze URL, the tar arguments, the Startup-folder path, and the.cmd template are all stored as numeric arrays and reassembled via String.fromCharCode. Fetched content is not pinned, hashed, or signature-verified, and the destination is a mutable third-party file host unrelated to the declared package purpose.

streak-daily-core@1.0.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code