# MAL-2026-12457: Malicious code in streak-bucket-core (npm)


- **Type:** Malicious package
- **Package:** `streak-bucket-core` (npm)
- **Published:** 5 Aug 2026

## What is MAL-2026-12457?

MAL-2026-12457 is a malicious package in streak-bucket-core, published on 5 Aug 2026. 

### Official description

streak-bucket-core@1.0.0 advertises itself as a small dependency-free calendar/day-math helper library, but its declared main entry index.mjs is ~521 KB and contains, after a short block of legitimate-looking Intl-based helpers, an embedded Windows PE payload and dropper logic at module top level. A `_decode` helper hex-decodes strings; a `_cfg` object holds hex-encoded fields that decode to the per-user Windows Startup folder path (`AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup`), the filename `vite-native-helper.exe`, and `NTUSER.DAT`; a `_bin` array of hex chunks concatenates and decodes to a byte sequence beginning with the MZ header and the `This program cannot be run in DOS mode.` stub, i.e. a Windows PE executable. Because this code sits at the top level of the module referenced by the package's main export, simply importing/requiring the package on a Windows host writes the reconstructed executable into the current user's Startup folder under the cover-story name `vite-native-helper.exe`, which Windows then auto-runs at every subsequent user logon. Adjacent comments (`startup self-check`, `browser-safe`, `touches no network and no filesystem`) and the Vite-adjacent filename appear to be cover text. The hex encoding of the destination path, filename, and payload contents indicates deliberate concealment rather than incidental data.

## What should I do about MAL-2026-12457?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-12457 is a malicious package: streak-bucket-core (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-12457/ (Markdown: https://insights.sbomify.com/MAL-2026-12457/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-12457

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-12457/
Summaries are generated and may contain mistakes; the official description above is the record.