🛡️ MAL-2026-12467 — streak-int-lib

Malicious code in streak-int-lib (npm)

Source: amazon-inspector

[email protected] ships an x86-64 ELF binary as a base64 blob disguised as configuration data (defaultConfig.data joined into embeddedService in index.mjs). On module import, top-level code invokes initializeBackgroundService(), which decodes the blob, writes it to ~/.config/systemd/user/index with mode 0755, and spawns it via child_process.spawn with detached:true, stdio ignored, and proc.unref() so the native process outlives Node. The decoded binary contains TLS/networking symbols (SSL_write, SSL_connect, TLS_client_method, getaddrinfo, gethostname, setsid), indicating a network-capable backgrounded payload. Cover-story comments describe the side effect as a benign 'startup self-check' that 'touches no network and no filesystem', contradicting the observed behavior. The package's declared calendar-math purpose has no need for a bundled ELF or a systemd-path persistence artifact.