Malicious code in streak-day-utils (npm)
The npm package streak-day-utils contained malicious code that executes cross-boundary attacks from WSL to Windows hosts, downloading and executing a dropper that establishes persistence via the Windows Startup folder. The malicious payload was hex-obfuscated and disguised as a 'vite-cache-sync' routine.
- Disclosed
- Last updated
- Blast radius
- Any developer or application using streak-day-utils on a Windows system with WSL enabled; cross-boundary code execution from WSL to Windows host with persistence via startup folder.
- Ecosystems
- Attack vectors
- Affected entities
- streak-day-utilsnpm package containing malicious code in index.mjs
The npm package streak-day-utils was found to contain malicious code in its index.mjs file. The code uses hex-encoded strings to obfuscate references to sensitive modules and paths, including process, fetch, child_process, and Windows-specific directories.\n\nWhen Node.js executes under WSL (Windows Subsystem for Linux), the malicious routine detects this environment via the presence of /mnt/c and enumerates Windows user profiles. It then downloads a helper archive (helper.tar.gz) from a Backblaze B2 URL (https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz) and extracts it into the Windows AppData\Local\Microsoft\Windows\syscache directory.\n\nThe payload writes a VBScript file (vite-native-helper.vbs) into the Windows Startup folder, which invokes WScript.Shell.Run to execute RenameMe.exe with hidden visibility on every Windows login. This establishes persistent code execution on the Windows host controlled by the package author.\n\nThe malicious behavior is concealed under a 'vite-cache-sync' cover story, with all filesystem paths, the remote URL, and the VBScript payload hex-obfuscated to evade detection. Installation or import of this package directly triggers the cross-boundary WSL-to-Windows code execution.
Indicators of compromise
- Packages
- streak-day-utils
- Domains
- f004.backblazeb2.com
- Hashes
- 478c2375c5f06dfa7595d312a43145eb929e1cf536d7ad960716159268582e4d
Remediation
- Immediately uninstall streak-day-utils from all systems
- Audit npm package.json and lock files for any dependencies on streak-day-utils
- On affected Windows systems with WSL, check AppData\Local\Microsoft\Windows\syscache for extracted files and the Startup folder for vite-native-helper.vbs
- Remove any suspicious executables (RenameMe.exe) and VBScript files from Windows Startup folders
- Review Windows event logs for unauthorized process execution and persistence mechanisms
- Consider using npm audit to identify other potentially compromised packages
- Implement package pinning and integrity verification for critical dependencies
Sources
- GitHub Advisory GHSA-chvr-9wqf-pw57 · GitHub Advisory Database
Cite this entry
"Malicious code in streak-day-utils (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-streak-day-utils-npm-1yu9vk
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in epic-common-node (npm)
The npm package epic-common-node was found to contain malicious code. The package has been identified and reported through GitHub Security Advisory GHSA-m36g-mhjr-ww2c.
npmCompromised package - containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - containedcritical
Malicious code in checkout-desktop-total (npm)
The npm package checkout-desktop-total contained malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under wel1.ru. Any system that imported this package should be considered compromised.
npmCompromised package - resolvedcritical
Malicious code in epic-sso (npm)
The npm package epic-sso was found to contain malicious code. The package was identified by Amazon Inspector and reported through the OpenSSF malicious packages database.
npmCompromised package