🛡️ MAL-2026-12469 — streak-math-lib

Malicious code in streak-math-lib (npm)

Source: amazon-inspector

On module import, index.js decodes a hex-obfuscated string table to reconstruct a Backblaze B2 URL and a set of Windows filesystem paths, then gates execution on running under WSL (Linux with WSL_DISTRO_NAME set) and NODE_ENV!= 'production'. When gated in, it downloads helper.tar.gz from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz, extracts helper/RenameMe.exe into the Windows-side user profile at AppData/Local/Microsoft/Windows/syscache/helper/, and writes an env-setup.cmd loader into the Windows Start Menu Startup folder that launches the extracted binary at next Windows login. The destination URL, executable name, AppData subpath, Startup folder path, and.cmd loader body are all stored as hex strings in a _c table and reassembled at runtime via a Buffer.from(s,'hex').toString() helper; comments frame the routine as a benign 'cache-resolver'. The WSL-only gating, NODE_ENV production skip, hex obfuscation of all identifying strings, opaque binary payload from an anonymous cloud bucket, and Startup-folder persistence together constitute an import-time dropper delivering an unverified Windows executable with autorun on the installer's host.