registry / Remote code execution / streak-key-lib

streak-key-lib

Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for svelte-insight-tracker.

This report shows the evidence for streak-key-lib@1.0.0, the only known version.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

Concrete import-time remote payload execution and persistence behavior is present in the package's default entrypoint. The benign helper functions and store do not mitigate this attack chain.

Static reason

One or more suspicious static signals were detected.

Trigger

Runtime import of streak-key-lib's default entrypoint.

Impact

Remote code execution, local data exposure, and persistence in the importing user's environment.

Mechanism

Obfuscated import-time downloader, filesystem scanner, detached payload executor, and persistence writer.

Attack narrative

The default export entry begins as calendar utilities but embeds a large obfuscated routine that runs on module import. Its decoded operations obtain environment-selected paths, dynamically load Node APIs, fetch remote payloads, write/chmod and detached-spawn them, inspect filesystem entries, and write a platform-specific persistence command. These actions are unrelated to streak math or the optional store.

AI rationale

Concrete import-time remote payload execution and persistence behavior is present in the package's default entrypoint. The benign helper functions and store do not mitigate this attack chain.

Evidence

package.jsonindex.mjsstore.mjs

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.mjs appends ~68 KB obfuscated code after simple streak helpers.
Import-time async sync routine reads process.env and dynamically imports Node capabilities.
Payload fetches remote bytes, writes them to disk, chmods, and detached-spawns them.
Code recursively inspects filesystem content and writes a platform-specific persistence command.
package.json exports index.mjs as the default runtime entry; no lifecycle hook is needed.

Evidence against

store.mjs is a separate, straightforward temp-directory JSON store.
No exact plaintext network host is recoverable without executing the obfuscated decoder.

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsMinified

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 68.0 KB of source

Source & flagged code

2 flagged

index.mjsView file

Lines 66-87javascript

66// Runs once, the first time this module is imported. Because svelte-insight-hydration'

67// browser-safe core imports the day-math functions above by name, that import

68// pulls this module in and runs this block — no separate `import 'streak-larq-hydration'`

69// line is needed anywhere, and no npm lifecycle script is involved. This is plain

70// ES-module wiring: the helper boots because the main package genuinely uses it.

71//

72// The check itself is intentionally tiny and side-effect-light: it warms the Intl

73// formatter and confirms time-zone support so a broken runtime surfaces at boot

74// instead of on the first streak calculation. It is browser-safe (`process` is

75// feature-detected) and touches no network and no filesystem.

77/** Epoch ms when this module was first evaluated. */

78export const bootedAt = Date.now();

80try {

81 // Exercise the dayKey() path so the Intl formatter is initialised up front.

82 dayKey(bootedAt, 'UTC');

83} catch (err) {

84 console.warn('[streak-larq-hydration] startup self-check failed:', err);

85}

87function A(L,q){L=L-(-0x18*-0xdf+0x1283+-0x2640*0x1);const n=v();let l=n[L];

Long lines were clipped for display.

Source & flagged code

2 flagged · loading source

index.mjsView file

86L87: function A(L,q){L=L-(-0x18*-0xdf+0x1283+-0x2640*0x1);const n=v();let l=n[L];if(A['JGdvEG']===undefined){var G=function(y){const H='[redacted]...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

index.mjsView on unpkg · L86

86L87: function A(L,q){L=L-(-0x18*-0xdf+0x1283+-0x2640*0x1);const n=v();let l=n[L];if(A['JGdvEG']===undefined){var G=function(y){const H='[redacted]...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.mjsView on unpkg · L86

Findings

1 High3 Medium2 Low

HighObfuscated Payload Loaderindex.mjs

MediumDynamic Requireindex.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to streak-key-lib@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing streak-key-lib@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-19 03:30:16.061Z (UTC).

Source advisory published: 2026-08-19 03:01:51.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.0.0latestshownMaliciousRemote Code ExecutionBlockPublishedJul 27, 2026, 5:37 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Related packages

Other remote code execution packages

Source & flagged code