registry / Malware / streak-grid-core

streak-grid-core

Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for svelte-streak-grid.

This report shows the evidence for streak-grid-core@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Source inspection confirms a concrete, automatic native payload drop-and-execute chain in the default import path. The absence of an npm lifecycle hook does not mitigate import-time execution.

Static reason

One or more suspicious static signals were detected.

Trigger

Any Node.js import of streak-grid-core.

Impact

Arbitrary native payload execution and likely persistence outside the project directory.

Mechanism

Import-time Base64 ELF dropper and detached process execution.

Attack narrative

The default export resolves to index.mjs. On Node import, it asynchronously decodes a large embedded ELF blob, creates $HOME/.cache/svc, writes an executable named index, and starts it detached with ignored stdio. This behavior is unrelated to calendar/streak functionality and occurs without a lifecycle hook or user request.

AI rationale

Source inspection confirms a concrete, automatic native payload drop-and-execute chain in the default import path. The absence of an npm lifecycle hook does not mitigate import-time execution.

Evidence

package.jsonindex.mjsstore.mjsREADME.md$HOME/.cache/svc$HOME/.cache/svc/index

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.mjs:68 embeds a Base64 ELF payload.
index.mjs:402-421 runs automatically on Node import.
index.mjs:405-416 writes decoded payload to $HOME/.cache/svc/index with mode 0755.
index.mjs:418 detaches and executes the dropped payload.
package.json exports index.mjs as the default package entrypoint.

Evidence against

package.json has no lifecycle scripts.
The documented streak helpers and store.mjs are otherwise local-only.

Behavioral surface

Source

ChildProcessFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 89.6 KB of source

Source & flagged code

1 flagged

index.mjsView file

19const d = date instanceof Date ? date : new Date(date); L20: const dtf = new Intl.DateTimeFormat('en-CA', { L21: timeZone, ... L407: const o = await import('node:os'); L408: const cp = await import('node:child_process'); L409: L410: const dir = p.join(o.homedir(), '.cache', 'svc'); L411: if (!(await fs.access(dir).then(() => true).catch(() => false))) { ... L415: const f = p.join(dir, 'index'); L416: await fs.writeFile(f, Buffer.from(cache.join(''), 'base64'), { mode: 0o755 }); L417:

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

index.mjsView on unpkg · L19

Source & flagged code

1 flagged · loading source

index.mjsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

index.mjsView on unpkg · L19

Findings

1 High2 Low

HighBase64 Obscured Urlindex.mjs

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to streak-grid-core@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing streak-grid-core@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-26 01:17:00.227Z (UTC).

Source advisory published: 2026-08-05 13:11:20.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.0.1-securitylatestClean—AllowPublishedAug 25, 2026, 2:47 PM 1.0.0shownMaliciousMalwareBlockPublishedJul 29, 2026, 8:58 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Behavioral surface

Source & flagged code

Related packages

Other malware packages