MAL-2026-12469 Malicious code in streak-math-lib (npm)

On module import, index.js decodes a hex-obfuscated string table to reconstruct a Backblaze B2 URL and a set of Windows filesystem paths, then gates execution on running under WSL (Linux with WSL_DISTRO_NAME set) and NODE_ENV!= 'production'. When gated in, it downloads helper.tar.gz from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/helper.tar.gz, extracts helper/RenameMe.exe into the Windows-side user profile at AppData/Local/Microsoft/Windows/syscache/helper/, and writes an env-setup.cmd loader into the Windows Start Menu Startup folder that launches the extracted binary at next Windows login. The destination URL, executable name, AppData subpath, Startup folder path, and.cmd loader body are all stored as hex strings in a _c table and reassembled at runtime via a Buffer.from(s,'hex').toString() helper; comments frame the routine as a benign 'cache-resolver'. The WSL-only gating, NODE_ENV production skip, hex obfuscation of all identifying strings, opaque binary payload from an anonymous cloud bucket, and Startup-folder persistence together constitute an import-time dropper delivering an unverified Windows executable with autorun on the installer's host.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.