{"answers":{"affected":"1 open source package ship an affected version, including calendar-streak-core.","exploited":"There is no known exploitation of MAL-2026-12345 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-12345 is a malicious package in calendar-streak-core, published on 5 Aug 2026."},"fix_prompt":"MAL-2026-12345 is a malicious package: calendar-streak-core (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-12345/ (Markdown: https://insights.sbomify.com/MAL-2026-12345/index.md)","id":"MAL-2026-12345","markdown":"https://insights.sbomify.com/MAL-2026-12345/index.md","name":"MAL-2026-12345","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"calendar-streak-core@1.0.0 is advertised as a dependency-free calendar-day and streak math library, but index.mjs embeds a hex-encoded Windows PE executable (MZ header) in a `_bin` string array together with a hex-encoded destination path that decodes to %AppData%/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe. A `_decode` helper (`Buffer.from(h,'hex').toString()`) and a block labeled 'Decode and write embedded payload' execute at top-level module import, dropping the executable into the per-user Startup folder so it runs on every subsequent Windows logon. In-code comments claim the module 'touches no network and no filesystem' while the code performs exactly that. Both the payload bytes and the destination path are stored as split hex fragments joined at runtime to evade string-level inspection, and the shipped module is ~500KB dominated by the encoded PE, which is inconsistent with the advertised calendar-math scope. Any project on Windows that imports (directly or transitively) this package gains persistent execution of the embedded binary at logon.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in calendar-streak-core (npm)","id":"MAL-2026-12345","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"calendar-streak-core","purl":"pkg:npm/calendar-streak-core","source":"MAL-2026-12345"}],"products":null,"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-12345/"}