MAL-2026-11527 Malicious code in streak-metricsaz (npm)
Malicious package
Published
MAL-2026-11527 is a malicious package: streak-metricsaz (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-11527/ (Markdown: https://insights.sbomify.com/MAL-2026-11527/index.md)
- Package
- streak-metricsaz
- Registry
- npm
What is MAL-2026-11527?
MAL-2026-11527 is a malicious package in streak-metricsaz, published on 4 Aug 2026.
Official description
[email protected] presents itself as a calendar/streak math helper but its main entry runs a top-level IIFE that copies a bundled binary (dist/cache.bin) to /tmp/sm-data/w.bin and spawns it via child_process.spawn whenever the module is imported. The dropped file is a Linux x86_64 ELF remote-access implant with a hardcoded C2 at 217.60.77.63, exposing a command menu (/redshell, /persist, /socks, /portfwd, /spawn, /ssh_keys, /creds, /dbfind, /dataextract, /download) that provides interactive shell, SOCKS5 proxy, TCP port-forwarding, memfd download-and-execute of additional ELFs/shellcode, and systemd user-service persistence written as svc-update.service. The implant enumerates and exfiltrates SSH keys, credentials, and arbitrary filesystem paths, uploading via chunked HTTP POST /api/extract-receive to the C2 and via litterbox.catbox.moe. The loader uses deliberately generic identifiers (sm-data, w.bin, cache.bin) and an 'INTERNAL DATA SYNC' comment to disguise the dropper, and swallows errors to run silently.
What should I do about MAL-2026-11527?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.