# MAL-2026-11148: Malicious code in streak-core-lib (npm)


- **Type:** Malicious package
- **Package:** `streak-core-lib` (npm)
- **Published:** 28 Jul 2026

## What is MAL-2026-11148?

MAL-2026-11148 is a malicious package in streak-core-lib, published on 28 Jul 2026. 

### Official description

streak-core-lib@1.0.0 presents itself as a 'day-math primitives' library, but index.mjs (the package main, executed on any require/import) contains an end-of-file async IIFE that decodes a hex-encoded Windows PE binary embedded in the source and writes it to the current user's Startup folder as vite-native-helper.exe (%AppData%/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe). The destination path components and filename are stored as hex-literal arrays joined and Buffer.from(h,'hex')-decoded at runtime to hide the strings from static inspection, and the embedded payload begins with the MZ header 4D5A90 characteristic of a Windows PE executable. Files placed in the Startup folder execute automatically at every user logon, giving the dropped binary persistent code execution on the installer's Windows host. Inline comments in the file falsely assert that the module 'touches no network and no filesystem' and needs 'no npm lifecycle script', which is contradicted by the fs.writeFile call in the same file. The behavior does not match the package's advertised purpose and fires on import without any user interaction beyond installing the package.

## What should I do about MAL-2026-11148?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-11148 is a malicious package: streak-core-lib (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-11148/ (Markdown: https://insights.sbomify.com/MAL-2026-11148/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-11148

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-11148/
Summaries are generated and may contain mistakes; the official description above is the record.