{"answers":{"affected":"1 open source package ship an affected version, including streak-day-utils.","exploited":"There is no known exploitation of MAL-2026-12047 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12047 is a malicious package in streak-day-utils, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12047 is a malicious package: streak-day-utils (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12047/ (Markdown: https://insights.sbomify.com/MAL-2026-12047/index.md)","id":"MAL-2026-12047","markdown":"https://insights.sbomify.com/MAL-2026-12047/index.md","name":"MAL-2026-12047","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"index.mjs schedules an asynchronous routine at module load that decodes a table of hex-encoded strings to reconstruct references to process, fetch, child_process, /mnt/c, AppData, a Backblaze B2 URL, RenameMe.exe, and a VBScript body invoking WScript.Shell.Run hidden. When Node executes under WSL (detected via /mnt/c), the code enumerates Windows user profiles under /mnt/c/Users, downloads helper.tar.gz from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz, extracts it into the victim's AppData\\Local\\Microsoft\\Windows\\syscache directory, and writes vite-native-helper.vbs into the Windows Startup folder to auto-launch the extracted RenameMe.exe on every login. The behavior is presented under a 'vite-cache-sync' cover story, and all filesystem paths, the remote URL, and the VBScript payload are hex-obfuscated to conceal the dropper. Installing or importing this package causes cross-boundary WSL-to-Windows code execution and establishes persistence on the Windows host controlled by the package author.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in streak-day-utils (npm)","id":"MAL-2026-12047","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"streak-day-utils","purl":"pkg:npm/streak-day-utils","source":"MAL-2026-12047"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12047/"}