Malicious code in streak-core-math (npm)
The npm package streak-core-math contained malicious code that downloads and executes a binary on Windows developer machines. The payload fetches a ZIP file from Backblaze B2, unpacks it, and establishes persistence via a VBS launcher in the Windows Startup folder.
- Disclosed
- Last updated
- Blast radius
- Developers on Windows machines who installed streak-core-math during the malicious period.
- Ecosystems
- Attack vectors
- Affected entities
- streak-core-mathnpm package containing malicious code in index.mjs
The npm package streak-core-math was found to contain malicious code in its index.mjs file. On import, the code executes a top-level async IIFE that fetches a ZIP archive from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.zip and unpacks it into %LOCALAPPDATA%/Microsoft/Windows/sysache.\n\nThe malware establishes persistence by writing vite-native-helper.vbs to the current user's Windows Startup folder. This VBS launcher uses WScript.Shell to execute the unpacked RenameMe.exe on every user logon, ensuring the fetched binary runs with the privileges of the logged-in user.\n\nTo evade detection, all sensitive strings—including the remote URL, function names, file paths, and VBS code—are stored as hex literals in a _c table and decoded at runtime using Buffer.from(h,'hex').toString(). Execution is gated to skip CI environments, production Node.js, and browser contexts, targeting specifically developer Windows machines.\n\nThe incident was identified by the OpenSSF's malicious-packages project and reported via GitHub Security Advisory GHSA-g827-wm64-px2q.
Indicators of compromise
- Packages
- streak-core-math
- Domains
- f004.backblazeb2.com
Remediation
- Immediately uninstall streak-core-math from all development machines
- Scan Windows systems for the presence of vite-native-helper.vbs in the Startup folder and remove it
- Check %LOCALAPPDATA%/Microsoft/Windows/sysache for unpacked binaries and delete them
- Review process execution logs for RenameMe.exe or other suspicious processes launched from Startup
- Audit npm package.json and lock files to identify all installations of streak-core-math
- Consider using npm audit or similar tools to detect other potentially compromised dependencies
- Rotate any credentials or sensitive data that may have been exposed on affected machines
Sources
- GitHub Advisory GHSA-g827-wm64-px2q · GitHub Advisory Database
Cite this entry
"Malicious code in streak-core-math (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-streak-core-math-npm-1iuwon
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @omniwatch-wick/cli
Malware discovered in the npm package @omniwatch-wick/cli. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in chain-manager
Malware discovered in the npm package chain-manager. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in toll_free (npm)
The npm package toll_free version 1.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - containedcritical
Malicious code in blots (npm)
The npm package 'blots' version 2.1.0 was identified by the OpenSSF Package Analysis project as containing malicious code that executes commands associated with malicious behavior. The package has been flagged in the OpenSSF malicious packages database.
npmCompromised package