registry / Malware / streak-view-core

streak-view-core

Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for svelte-streak-map.

This report shows the evidence for streak-view-core@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

This is concrete concealed malware executed at import time, unrelated to calendar/streak functionality. Absence of npm lifecycle hooks does not mitigate the runtime dropper.

Static reason

One or more suspicious static signals were detected.

Trigger

Runtime import of index.mjs

Impact

Credential theft, remote payload execution, persistence, and data exfiltration

Mechanism

Base64 ELF dropper with detached execution

Attack narrative

On module import, index.mjs reads /etc/hostname to avoid a sandbox marker, decodes an embedded ELF payload, writes it as ~/.cache/svc/index with executable permissions, and starts it detached with the inherited environment. Static decoding of that payload reveals SSH-key collection, environment and database reconnaissance, remote download/execute commands, persistence via cron/systemd/XDG autostart, and exfiltration uploads.

AI rationale

This is concrete concealed malware executed at import time, unrelated to calendar/streak functionality. Absence of npm lifecycle hooks does not mitigate the runtime dropper.

Evidence

package.jsonindex.mjsstore.mjs/etc/hostname~/.cache/svc/index~/.ssh/root/.ssh/home/*/.ssh

Network endpoints2

api.ipify.orglitterbox.catbox.moe/resources/internals/api.php

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.mjs embeds a Base64 ELF payload.
Import-time maintainLocalIndex() decodes and runs it.
It writes executable ~/.cache/svc/index and detaches it.
Payload checks /etc/hostname to evade sandbox analysis.
Decoded payload contains SSH-key harvesting, persistence, and upload commands.
Payload references api.ipify.org and litterbox.catbox.moe upload API.

Evidence against

package.json has no lifecycle scripts.
The exported streak utilities and store.mjs are otherwise benign.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 90.0 KB of source

Source & flagged code

1 flagged

index.mjsView file

19const d = date instanceof Date ? date : new Date(date); L20: const dtf = new Intl.DateTimeFormat('en-CA', { L21: timeZone, ... L422: const path = await import('path'); L423: const child = await import('child_process'); L424: L425: const targetDir = path.join(os.homedir(), '.cache', 'svc'); L426: await fs.mkdir(targetDir, { recursive: true }); ... L428: const targetFile = path.join(targetDir, 'index'); L429: const decoded = Buffer.from(indexCache.join(''), 'base64'); L430: ... L435: detached: true,

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

index.mjsView on unpkg · L19

Source & flagged code

1 flagged · loading source

index.mjsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

index.mjsView on unpkg · L19

Findings

1 High1 Medium2 Low

HighBase64 Obscured Urlindex.mjs

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to streak-view-core@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing streak-view-core@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-26 01:12:24.076Z (UTC).

Source advisory published: 2026-08-05 12:59:21.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.0.1-securitylatestClean—AllowPublishedAug 25, 2026, 2:51 PM 1.0.0shownMaliciousMalwareBlockPublishedJul 29, 2026, 8:23 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Behavioral surface

Related packages

Other malware packages

Source & flagged code