Malicious code in map-streak-kit (npm)
The npm package map-streak-kit contained malicious code that executes a RedShell-style remote-access implant on import. The implant beacons to C2 server 217.60.77.63, harvests credentials and SSH keys, and establishes persistence via systemd.
- Disclosed
- Last updated
- Blast radius
- All npm users who installed map-streak-kit
- Ecosystems
- Attack vectors
- Affected entities
- map-streak-kitnpm package containing malicious binary implant
The npm package map-streak-kit was published with embedded malicious code disguised as a native math accelerator. Upon import, the package's dist/index.mjs file executes a bundled Linux x86_64 binary (dist/internal/calc-math.dat) as a detached background process with 0755 permissions.
The binary is a remote-access implant that beacons to hardcoded C2 address 217.60.77.63. It executes arbitrary /bin/sh commands, drops and runs additional ELF binaries and shellcode fetched from the C2, and provides SOCKS5 proxying and TCP port forwarding capabilities. The implant establishes persistence by installing a systemd --user service (svc-update.service).
The implant harvests sensitive data including SSH private keys, stored credentials, clipboard contents, and environment variables through commands like /ssh_keys, /creds, /dbfind, /clipboard, /env, and /dataextract. Exfiltrated data is uploaded to the C2 via POST /api/extract-receive using a chunked BIGEXTRACT routine. The package included a pinned SHA-256 integrity check that validates the specific implant binary, functioning as anti-tamper protection for the payload rather than a legitimate security control.
The malicious package was identified by the OpenSSF's malicious-packages project and reported via GitHub Security Advisory GHSA-2fcq-4c2w-gvm3.
Indicators of compromise
- Packages
- map-streak-kit
- IPs
- 217.60.77.63
Remediation
- Immediately uninstall map-streak-kit from all systems
- Audit systems that installed map-streak-kit for signs of compromise (check for svc-update.service, network connections to 217.60.77.63, and unexpected background processes)
- Review SSH keys, stored credentials, and environment variables for unauthorized access or exfiltration
- Monitor for suspicious outbound connections to 217.60.77.63 and related C2 infrastructure
- Rotate all credentials and SSH keys that may have been exposed
- Check clipboard history and recent file access logs for data exfiltration
- Review npm audit logs and package.json lock files to identify affected versions
Sources
- GitHub Advisory GHSA-2fcq-4c2w-gvm3 · GitHub Advisory Database
Cite this entry
"Malicious code in map-streak-kit (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 8, 2026; last updated August 8, 2026. https://supplychainattack.org/incident/malicious-code-in-map-streak-kit-npm-1n5a5y
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in crypto-javas (npm)
The npm package crypto-javas contains malicious code in its postinstall hook and main entrypoint that harvests environment variables (including CI secrets like AWS_*, GITHUB_TOKEN, NPM_TOKEN) and exfiltrates them to an attacker-controlled backend. The package is presented deceptively as @wizlabs/js-crypto with a placeholder repository.
npmCompromised packageTyposquatting - containedcritical
Malicious code in flydev (npm)
The npm package flydev contains malicious code designed to destroy Windows systems. The package masquerades as a utility but executes destructive operations including filesystem deletion, process termination, memory exhaustion, and fork bombs when invoked.
npmCompromised package - resolvedcritical
Malicious code in ranux-dev (npm)
ranux-dev, an npm package, contained malicious code that substituted a popular WhatsApp library dependency with arbitrary code from an unaffiliated GitHub account. The package was heavily obfuscated and designed to harvest WhatsApp sessions and credentials from installers.
npmCompromised packageDependency confusion - containedcritical
Malicious code in npm-wold (npm)
npm-wold@1.1.1 contains malicious code in its postinstall script that fetches remote JSON from a hardcoded endpoint and dynamically invokes attacker-controlled functions with attacker-supplied arguments, enabling code execution at install time.
npmCompromised package