Malicious code in streak-daily-lib (npm)
The npm package streak-daily-lib contained malicious code that executes on import, downloads and executes binaries from attacker-controlled infrastructure, and establishes persistence on Windows hosts via WSL. The package was published with a benign stated purpose (calendar/streak math) but implements a sophisticated supply chain attack with cross-platform capabilities.
- Disclosed
- Last updated
- Blast radius
- npm ecosystem; developers using streak-daily-lib on Linux/WSL systems with Windows host access
- Ecosystems
- Attack vectors
- Affected entities
- streak-daily-libnpm package containing malicious code in index.mjs
The npm package streak-daily-lib was found to contain malicious code in its index.mjs file that executes automatically on import. The malicious routine uses hex-encoded string arrays to obfuscate network destinations, decoding to the host f004.backblazeb2.com with path prefix /file/dp8hbvocjd2fpza/.
The attack chain downloads helper.tar.gz and a background-service binary via HTTPS, writes them to disk, extracts the tarball, and launches the service with elevated permissions. The code then exploits WSL (Windows Subsystem for Linux) to escape to the Windows host filesystem, dropping a vite.exe binary into %APPDATA%\Local\Microsoft\Windows\syscache and writing a startup script (env-setup.cmd) to %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ to achieve persistence across reboots.
The package's stated purpose—calendar and streak mathematics—bears no relation to the fetched binaries, hex-obfuscated identifiers, or Windows persistence mechanisms. The attack demonstrates multiple sophisticated techniques: import-time auto-execution, runtime host obfuscation, unverified binary download and execution, WSL-to-Windows privilege boundary crossing, and login-time persistence.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- streak-daily-lib
- Domains
- f004.backblazeb2.com
Remediation
- Review the linked advisory; remove or upgrade the affected component and rotate any exposed credentials.
Sources
- GitHub Advisory GHSA-456x-5qpf-qrrw · GitHub Advisory Database
Cite this entry
"Malicious code in streak-daily-lib (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 28, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-streak-daily-lib-npm-1866m6
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- activecritical
Malware in @omniwatch-wick/cli
Malware discovered in the npm package @omniwatch-wick/cli. Systems with this package installed are considered fully compromised and require immediate remediation.
npmCompromised package - activecritical
Malware in chain-manager
Malware discovered in the npm package chain-manager. Systems with this package installed or running are considered fully compromised and require immediate remediation.
npmCompromised package - containedcritical
Malicious code in toll_free (npm)
The npm package toll_free version 1.0.1 was identified as malicious by the OpenSSF Package Analysis project. The package executes commands associated with malicious behavior.
npmCompromised package - containedcritical
Malicious code in blots (npm)
The npm package 'blots' version 2.1.0 was identified by the OpenSSF Package Analysis project as containing malicious code that executes commands associated with malicious behavior. The package has been flagged in the OpenSSF malicious packages database.
npmCompromised package