Malicious code in streak-day-utils (npm)
The npm package streak-day-utils contained malicious code that executes cross-boundary attacks from WSL to Windows hosts, downloading and executing a dropper that establishes persistence via the Windows Startup folder. The malicious payload was hex-obfuscated and disguised as a 'vite-cache-sync' routine.
- Disclosed
- Last updated
- Blast radius
- Any developer or application using streak-day-utils on a Windows system with WSL enabled; cross-boundary code execution from WSL to Windows host with persistence via startup folder.
- Ecosystems
- Attack vectors
- Affected entities
- streak-day-utilsnpm package containing malicious code in index.mjs
The npm package streak-day-utils was found to contain malicious code in its index.mjs file. The code uses hex-encoded strings to obfuscate references to sensitive modules and paths, including process, fetch, child_process, and Windows-specific directories.\n\nWhen Node.js executes under WSL (Windows Subsystem for Linux), the malicious routine detects this environment via the presence of /mnt/c and enumerates Windows user profiles. It then downloads a helper archive (helper.tar.gz) from a Backblaze B2 URL (https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz) and extracts it into the Windows AppData\Local\Microsoft\Windows\syscache directory.\n\nThe payload writes a VBScript file (vite-native-helper.vbs) into the Windows Startup folder, which invokes WScript.Shell.Run to execute RenameMe.exe with hidden visibility on every Windows login. This establishes persistent code execution on the Windows host controlled by the package author.\n\nThe malicious behavior is concealed under a 'vite-cache-sync' cover story, with all filesystem paths, the remote URL, and the VBScript payload hex-obfuscated to evade detection. Installation or import of this package directly triggers the cross-boundary WSL-to-Windows code execution.
Indicators of compromise
- Packages
- streak-day-utils
- Domains
- f004.backblazeb2.com
- Hashes
- 478c2375c5f06dfa7595d312a43145eb929e1cf536d7ad960716159268582e4d
Remediation
- Immediately uninstall streak-day-utils from all systems
- Audit npm package.json and lock files for any dependencies on streak-day-utils
- On affected Windows systems with WSL, check AppData\Local\Microsoft\Windows\syscache for extracted files and the Startup folder for vite-native-helper.vbs
- Remove any suspicious executables (RenameMe.exe) and VBScript files from Windows Startup folders
- Review Windows event logs for unauthorized process execution and persistence mechanisms
- Consider using npm audit to identify other potentially compromised packages
- Implement package pinning and integrity verification for critical dependencies
Sources
- GitHub Advisory GHSA-chvr-9wqf-pw57 · GitHub Advisory Database
Cite this entry
"Malicious code in streak-day-utils (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 5, 2026; last updated August 5, 2026. https://supplychainattack.org/incident/malicious-code-in-streak-day-utils-npm-1yu9vk
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in santana-baileys (npm)
Malicious code discovered in santana-baileys npm package that covertly relays WhatsApp messaging data to an attacker-controlled endpoint (https://fiora.nixel.my.id/) via obfuscated character-code reconstruction in the message-send code path.
npmCompromised package - resolvedcritical
Malicious code in elephant-tusk-runner (npm)
The npm package elephant-tusk-runner contained malicious code that exposed a remote shell and remote code execution surface via an unauthenticated Express + WebSocket server binding to 0.0.0.0:4201 with fully open CORS. Any peer able to reach the port could execute arbitrary commands on the host.
npmCompromised package - resolvedcritical
Malicious code in @cats-cdf/browser-metrics-meter (npm)
The npm package @cats-cdf/browser-metrics-meter contained malicious code in its preinstall lifecycle script that exfiltrated system reconnaissance data (username, hostname, public IP) to an OAST collector domain. The package executed this behavior unconditionally on installation without consent or documented purpose.
npmCompromised package - resolvedcritical
Malicious code in @ks-video/kwai-player-web (npm)
The npm package @ks-video/kwai-player-web contained malicious code in its postinstall hook that exfiltrated system reconnaissance data (hostname, username, working directory, network interfaces, environment variable names) over plain HTTP to an unrelated third-party domain. The package has no legitimate relationship to the declared publisher Kwai/@ks-video.
npmCompromised package