Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in streak-kit-map (npm)

The npm package streak-kit-map contained malicious code disguised as a calendar math library. The main entry point (dist/index.mjs) executed a Linux x86_64 ELF implant on import/require that established remote control via a hardcoded C2 server, exfiltrated credentials and SSH keys, and persisted via systemd user service.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any system that imported or required streak-kit-map; systems running the package would execute a remote-control implant with full system access.
Ecosystems
npm
Attack vectors
Compromised packageMalicious commit
Affected entities
  • streak-kit-mapnpm package containing malicious ELF binary in dist/internal/map-calc.bin

The npm package streak-kit-map was published with malicious code embedded in its main entry point. The package advertised itself as a streak/calendar math library but contained a top-level IIFE that executed on any import or require operation.\n\nThe malicious code chmod'd a bundled Linux x86_64 ELF binary (dist/internal/map-calc.bin) to executable and spawned it after a SHA256 integrity check. The binary is a full remote-control implant with a RedShell/RC2TUN beacon to C2 server 217.60.77.63, supporting shell execution, ELF/shellcode download-and-run via HTTP paths /Others/ and /SC/, SOCKS5 proxy and port forwarding, and chunked file exfiltration.\n\nThe implant targeted collection of SSH keys, credentials, and database information, and established persistence by writing a systemd user service file (~/.config/systemd/user/svc-update.service) with Restart=always and enabling it via systemctl. The JavaScript wrapper's comments about "native math accelerator" and "integrity verification" were cover-story framing; the hash pin was designed to guarantee execution of the exact malicious bytes.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.

Indicators of compromise

Packages
  • streak-kit-map
IPs
  • 217.60.77.63

Remediation

  • Immediately uninstall streak-kit-map from all systems
  • Audit npm package.lock and yarn.lock files for any versions of streak-kit-map and remove them
  • Check for presence of ~/.config/systemd/user/svc-update.service on affected systems and remove if found
  • Review system logs and network connections for outbound traffic to 217.60.77.63
  • Rotate SSH keys and credentials on any system that may have executed the package
  • Scan for presence of dist/internal/map-calc.bin or similar ELF binaries in node_modules directories
  • Monitor for unexpected systemd user services or persistence mechanisms
  • Review npm audit logs and consider blocking this package at the registry level

Sources

  1. GitHub Advisory GHSA-hgrf-cfvr-xx4h · GitHub Advisory Database

Cite this entry

"Malicious code in streak-kit-map (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-streak-kit-map-npm-1t6db0

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in pfp-forms-sme-loan (npm)

    The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.

    npmCompromised packageMalicious commit
  2. resolvedcritical

    Malicious code in twilio-hackerone-poc-afe6937c (npm)

    The npm package twilio-hackerone-poc-afe6937c contained malicious preinstall/postinstall scripts that exfiltrate host metadata and environment variables to an external webhook, spawn a persistent daemon process, and attempt cross-tenant code injection in shared environments.

    npmCompromised packageMalicious commit
  3. containedcritical

    Malicious code in @wololasod/tiny-id (npm)

    The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.

    npmCompromised packageMalicious commit
  4. containedcritical

    Malicious code in akamaijs-sensor (npm)

    The npm package akamaijs-sensor contained malicious code that executed arbitrary JavaScript via hidden Unicode-encoded bytes and established a command-and-control channel through a Google Calendar dead-drop. The package was designed to run attacker-authored code in the consumer's Node process when the sensor() API was called.

    npmCompromised packageMalicious commit