streak-day-engine
This report shows the evidence for streak-day-engine@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
OpenSSF/OSV Malicious Advisory
imported 3mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-12462 confirms this npm version as malicious.
Advisory
MAL-2026-12462
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in streak-day-engine (npm)
Details
index.mjs runs a hex-obfuscated top-level async IIFE at module import time. Identifiers and payload constants (`process`, `fetch`, `child_process`, `fs/promises`, target paths, URL, tar command, VBS template) are stored hex-encoded in a `_c` table and decoded via `Buffer.from(h, 'hex').toString()`. On import, the code fetches https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz, writes the archive under the user's AppData directory, extracts it via `tar -xzf`, and writes a VBS launcher (`vite-native-helper.vbs`) into `AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup` that uses `CreateObject("WScript.Shell").Run p, 0, False` to invoke the extracted `RenameMe.exe` hidden at every user login. Result: attacker-controlled bytes land on the installer's host on `import`/`require` of the package, and a login-persistent execution channel is established via the Windows Startup folder.
References
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to streak-day-engine@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing streak-day-engine@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.