🛡️ MAL-2026-12468 — streak-math-kit

Malicious code in streak-math-kit (npm)

Source: amazon-inspector

[email protected] is advertised as a math primitives library but its index.mjs top-level IIFE _bootstrap() runs on any import and drops a hex-embedded Windows PE named vite-native-helper.exe onto the host. Execution is gated by platform==='linux' && NODE_ENV!=='production' to target WSL developer environments. The code enumerates /mnt/c/Users/* to locate a Windows user profile (identified by the presence of AppData and NTUSER.DAT), then hex-decodes an approximately 500KB embedded binary with an MZ/PE header and writes it to that user's AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup directory, where Windows auto-executes it on the next logon. Path segments (AppData, Roaming, Startup subpath, NTUSER.DAT, the filename vite-native-helper.exe) are stored as hex-encoded string arrays and reassembled at runtime via Buffer.from(h,'hex') to hide the Windows-targeting behavior from casual source review. Source comments state the module has no network or filesystem side effects, contradicting the observed behavior. Result: any developer who imports this package from a WSL shell gains a persistent Windows executable that runs at every subsequent Windows logon.