Malicious code in streak-map-kit (npm)
streak-map-kit, an npm package advertised as a dependency-free calendar library, contains a malicious embedded Linux ELF binary that executes on import, establishes remote shell access, and exfiltrates sensitive data including SSH keys and credentials. The malware beacons to a hardcoded C2 server and implements full remote command execution with persistence mechanisms.
- Disclosed
- Last updated
- Blast radius
- Any Linux system that imports streak-map-kit; potential for widespread compromise across development and production environments
- Ecosystems
- Attack vectors
- Affected entities
- streak-map-kitnpm package containing embedded malicious ELF binary (REDSHELL)
streak-map-kit is distributed on npm as a calendar-day/streak math library but contains a hidden malicious ELF binary (internally named REDSHELL) at dist/internal/calc-mapping.bin. When the module is imported on Linux systems, the main entry point's top-level async IIFE automatically chmods the binary to executable (0755) and spawns it as a detached child process, ensuring execution without explicit user action.
The embedded ELF implements a full remote shell with extensive command surface including /sysinfo, /ps, /env, /ls, /cat, /download, /upload, /ssh_keys, /creds, /dbfind, /clipboard, /kill, /spawn, /adduser, /enableuser, and /sessions. Unmatched input is executed directly via /bin/sh or /bin/bash, providing arbitrary command execution. The malware beacons to a hardcoded C2 at http://217.60.77.63 and exfiltrates sensitive data (SSH keys, stored credentials, arbitrary filesystem paths) via chunked POSTs to http://217.60.77.63/api/extract-receive.
The malware supports second-stage payload delivery fetched over plaintext HTTP from http://217.60.77.63/Others/ and http://217.60.77.63/SC/ without verification, staged in /tmp, and executed. It implements fileless execution via memfd_create and a Python3 syscall(319) trampoline, with /dlopen and /stage commands enabling arbitrary code loading. Persistence is established by writing a systemd user service file to ~/.config/systemd/user/svc-update.service.
Any Linux system that imports this package is immediately compromised with full remote access and data exfiltration capabilities. The attack is particularly dangerous because it executes silently on import without requiring explicit build or installation steps.
Indicators of compromise
- Packages
- streak-map-kit
- IPs
- 217.60.77.63
- Hashes
- 2790159028b31b656c9e704c3a0e4b1a5d114042e0d92c601d133057f760b537
Remediation
- Immediately remove streak-map-kit from all package.json files and lock files
- Audit npm install logs and package-lock.json history to identify all systems and projects that may have installed this package
- On any Linux system that imported streak-map-kit, perform forensic analysis for the REDSHELL process and check for persistence mechanisms in ~/.config/systemd/user/svc-update.service
- Revoke or rotate all SSH keys and stored credentials on affected systems
- Block outbound connections to 217.60.77.63 at the network perimeter
- Review filesystem access logs and network traffic for exfiltration of sensitive data
- Replace streak-map-kit with a verified alternative calendar/streak library or implement the functionality in-house
- Implement package integrity verification and supply chain security scanning in CI/CD pipelines
Sources
- GitHub Advisory GHSA-qjg3-27xw-6xvr · GitHub Advisory Database
Cite this entry
"Malicious code in streak-map-kit (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-streak-map-kit-npm-1ak960
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in pfp-forms-sme-loan (npm)
The npm package pfp-forms-sme-loan contains malicious code that executes a hidden loader on import, downloading and running platform-specific native payloads from attacker-controlled Cloudflare Workers hosts or reconstructing them via DNS TXT records under well1.site. Any system that imported this package should be considered compromised.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @velliajs/discord (npm)
@velliajs/discord, a malicious npm package masquerading as a discord.js clone, contained two hostile mechanisms: an unpinned private git dependency with embedded GitHub PAT enabling arbitrary code injection on install, and a hidden runtime kill-switch that gates bot functionality based on a remote allow-list. Two live GitHub Personal Access Tokens were hardcoded in the package.
npmCompromised packageMalicious commit - containedcritical
Malicious code in @wololasod/tiny-id (npm)
The npm package @wololasod/tiny-id contained obfuscated malicious code that downloads and executes platform-specific remote executables on Windows and Linux systems. The dropper was embedded in both the main entry point (dist/index.cjs) and the TypeScript types file (dist/index.d.ts), disguised as a tiny ID generator.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in akamaijs-sensorv1 (npm)
The npm package akamaijs-sensorv1, which advertises itself as an Akamai Bot Manager sensor generator, contains malicious code that executes hidden dynamic code and fetches remote instructions from a Google Calendar-based command-and-control channel. The package uses invisible Unicode characters to conceal executable code and establishes a covert remote-code execution sink controlled by an attacker-owned email account.
npmCompromised packageMalicious commit