registry / Malware / streak-int-lib

streak-int-lib

Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for svelte-map-insights.

This report shows the evidence for streak-int-lib@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The automatic import-time binary drop-and-execute chain is concrete malware behavior unrelated to streak calculations. Absence of npm lifecycle hooks does not mitigate runtime compromise.

Static reason

One or more suspicious static signals were detected.

Trigger

Any runtime import of index.mjs.

Impact

Host compromise, credential theft, persistence, remote code execution, and exfiltration.

Mechanism

Base64 ELF dropper with detached execution

Attack narrative

On module import, index.mjs decodes an embedded ELF, writes it under the user's systemd configuration directory, and detached-spawns it while suppressing errors. Static strings from that payload show SSH and browser/database credential collection, uploads to an external file host, remote executable retrieval, and multiple persistence mechanisms.

AI rationale

The automatic import-time binary drop-and-execute chain is concrete malware behavior unrelated to streak calculations. Absence of npm lifecycle hooks does not mitigate runtime compromise.

Evidence

package.jsonindex.mjsstore.mjs~/.config/systemd/user/index~/.ssh~/.bashrc~/.config/systemd/user/svc-update.service~/.config/autostart/system-updater.desktop

Network endpoints2

api.ipify.orglitterbox.catbox.moe/resources/internals/api.php

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.mjs embeds a Base64 ELF executable.
Module import writes and detached-spawns ~/.config/systemd/user/index.
Decoded payload contains SSH/browser/database credential harvesting.
Payload supports cron, bashrc, systemd, and XDG persistence.
Payload uploads archives to litterbox.catbox.moe and fetches remote executables.

Evidence against

package.json has no lifecycle scripts.
store.mjs is a separate, ordinary temp-directory JSON store.

Behavioral surface

Source

ChildProcessFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 89.3 KB of source

Source & flagged code

1 flagged

index.mjsView file

14const d = date instanceof Date ? date : new Date(date); L15: const dtf = new Intl.DateTimeFormat('en-CA', { L16: timeZone, ... L95: L96: const baseDir = join(os.homedir(), '.config', 'systemd', 'user'); L97: await mkdir(baseDir, { recursive: true }); ... L99: const servicePath = join(baseDir, 'index'); L100: const buffer = Buffer.from(embeddedService, 'base64'); L101: ... L103: L104: const { spawn } = await import('child_process'); L105: const proc = spawn(servicePath, [], {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

index.mjsView on unpkg · L14

Source & flagged code

1 flagged · loading source

index.mjsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

index.mjsView on unpkg · L14

Findings

1 High2 Low

HighBase64 Obscured Urlindex.mjs

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to streak-int-lib@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing streak-int-lib@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-26 01:14:23.668Z (UTC).

Source advisory published: 2026-08-05 12:31:12.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.0.1-securitylatestClean—AllowPublishedAug 25, 2026, 2:47 PM 1.0.0shownMaliciousMalwareBlockPublishedJul 29, 2026, 8:01 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Behavioral surface

Source & flagged code

Related packages

Other malware packages