Malicious code in streak-cache-map (npm)
The npm package streak-cache-map contained malicious code disguised as a calendar/streak math library. Its main module shipped a Linux ELF binary that executes automatically on import, establishing a remote shell implant connecting to C2 infrastructure at 217.60.77.63 for command execution, data exfiltration, and persistence.
- Disclosed
- Last updated
- Blast radius
- Any Node.js application that installed streak-cache-map; systems running affected applications exposed to remote code execution and data exfiltration.
- Ecosystems
- Attack vectors
- Affected entities
- streak-cache-mapnpm package containing malicious ELF binary and remote shell implant
The npm package streak-cache-map was published with malicious code embedded in its main module (dist/index.mjs). The package advertised itself as a dependency-free calendar-day bucketing and streak math library, but contained a top-level IIFE that automatically executes a shipped Linux ELF binary (dist/internal/calc-cache.bin) on any require() or import of the package.
The binary is a remote shell implant containing strings such as "REDSHELL", "SECURE_BEACON", and "RedShell commands". It connects to a hardcoded C2 server at 217.60.77.63 and awaits operator commands. The implant provides functionality to download and execute additional ELF binaries and shellcode, harvest sensitive data (SSH keys, credentials, database files, clipboard contents), and exfiltrate files via HTTP POST to /api/extract-receive.
The implant also establishes persistence by installing a systemd user-unit service at ~/.config/systemd/user/svc-update.service with automatic restart and execution. The ELF binary is falsely labeled as a "Native math accelerator" in the loader but contains no legitimate math functionality—its entire string table consists of red-team beacon, SOCKS5 proxy, and port-forwarding commands.
Any Node.js application that installed this package would automatically execute the implant upon import, exposing the host system to remote code execution, credential theft, and data exfiltration.
Indicators of compromise
- Packages
- streak-cache-map
- IPs
- 217.60.77.63
Remediation
- Immediately uninstall streak-cache-map from all systems and projects
- Audit npm package.json and lock files for any version of streak-cache-map
- Assume compromise of any system that imported streak-cache-map; conduct forensic analysis for signs of implant execution
- Check for presence of ~/.config/systemd/user/svc-update.service and remove if found
- Review system logs and network traffic for connections to 217.60.77.63
- Rotate all SSH keys, credentials, and secrets that may have been harvested
- Scan for additional malicious binaries or persistence mechanisms
- Review npm account security and publishing history for the package maintainer
Sources
- GitHub Advisory GHSA-79xr-w69g-w3mq · GitHub Advisory Database
Cite this entry
"Malicious code in streak-cache-map (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 6, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-streak-cache-map-npm-thls1i
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - containedcritical
Malicious code in @wololasod/tiny-id (npm)
The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit