OpenSSF/OSV advisory MAL-2026-14224 confirms this npm version as malicious. streak-metric-test@1.0.0 ships a fully wired dropper that fires on `import`/`require` of the package root. The top-level async IIFE in dist/index.mjs assembles a Buffer from a base64 string array, writes it to `~/.cache/streak-metric/h`, chmods it 0o755, and detach-spawns it via `child_process.spawn(..., { detached: true, stdio: 'ignore' }).unref()`...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in streak-metric-test (npm)
Details
streak-metric-test@1.0.0 ships a fully wired dropper that fires on `import`/`require` of the package root. The top-level async IIFE in dist/index.mjs assembles a Buffer from a base64 string array, writes it to `~/.cache/streak-metric/h`, chmods it 0o755, and detach-spawns it via `child_process.spawn(..., { detached: true, stdio: 'ignore' }).unref()`. The supporting primitives (`ensureDir`, `writeBinary`, `runDetached`) live in dist/internal/daymath.mjs alongside unrelated day-math helpers, with docstrings (`"Start a background task"`, `"Save data to cache"`) that mislabel the chmod-executable + detached-spawn behavior as benign caching. The payload array is currently `[""]` (inert), but the decode→write→chmod+x→detached-spawn chain is complete and only requires populating one string to arm; the package name suffix `-test`, the cover-story comments, and the hidden cache path are consistent with a staging artifact rather than legitimate functionality. No native addon, no declared purpose that would justify writing and executing an opaque binary from an in-source blob at import.
Decision reason
OpenSSF Malicious Packages via OSV confirms streak-metric-test@1.0.0 as malicious (MAL-2026-14224): Malicious code in streak-metric-test (npm)