registry / streak-metric-core / 1.0.0

streak-metric-core@1.0.0

Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for svelte-streak-metric.

AI Security Review

scanned 16d ago · by lpm-firewall-ai

Importing the package on Node downloads an opaque remote payload, saves it in the user's home cache, and executes it detached. This occurs without an explicit user command.

Static reason

No blocking static signals were detected.

Trigger

Importing streak-metric-core in a Node environment with HOME set.

Impact

Arbitrary remote code executes as the importing user's account and can persist independently.

Mechanism

import-time remote binary download, chmod, and detached execution

Attack narrative

At module import, dist/index.mjs dynamically loads Node HTTPS and path modules, builds an obfuscated Backblaze URL, downloads its response, and writes it to $HOME/.cache/streak-metric/service. The helper functions in dist/internal/daymath.mjs set executable permissions and launch that file detached with ignored stdio. The payload is remote and unauthenticated, so the package grants its operator arbitrary code execution whenever consumers import the package.

Rationale

The stated calendar/streak functionality does not require fetching and executing an opaque native binary. The behavior is concealed with character-code URL construction and runs automatically at import time.

Evidence

package.jsondist/index.mjsdist/internal/daymath.mjs$HOME/.cache/streak-metric$HOME/.cache/streak-metric/service

Network endpoints1

f004.backblazeb2.com/file/dp8hbvocjd2fpza/service

OSV Corroboration

On any `require`/`import` of streak-metric-core, top-level code in the main entry reconstructs a URL from `String.fromCharCode` integer arrays, resolving to https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/service. The package downloads that opaque binary, writes it to `~/.cache/streak-metric/service`, chmods it to 0755, and spawns it detached with a randomized delay via `spawn(p, [], { detached: true }).unref()`. There is no hash or signature verification, the destination is an anonymous Backblaze B2 bucket unrelated to any declared publisher infrastructure, and the URL is reconstructed at runtime specifically to avoid appearing as a plain string. A comment frames the behavior as an 'optional runtime accelerator', but the code executes unconditionally at module load. This grants the package author arbitrary code execution on the installer's host at import time.

streak-metric-core@1.0.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code