{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "dist/index.mjs",
              "sha256": "969ef45e5e1c382d421580b8306aff0abf0c4d302f0af7091ac44ce70a92f789",
              "tlsh": "80413466afbd633897fc07c28e38b193292d84431f96d995d94e473861c0b58e3c0979"
            },
            {
              "path": "dist/internal/calc-math.dat",
              "sha256": "4537b1189ce419f1a595cf47216c03f80e9170ce80dad8d9227a1e52f9cb3466",
              "tlsh": "83531a2bbdc28e3fc084d53087dfd42269b5705aaa33712f26111f293d59a69473f72a"
            }
          ],
          "package_integrity": [
            {
              "filename": "map-streak-kit-1.0.0.tgz",
              "hashes": {
                "sha1": "2a54002c989b8d78a6535e8180610b427c96139d",
                "sha512_sri": "sha512-VVQw4akc+KKbuDqtd6ybXy4Uz1kCVmmCZWvMTY3nxj0vVtpJl6F7cAFoDwQ68BIDMtpX7npxWG99Qxl3Mb6U+g=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "map-streak-kit"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-017168",
        "import_time": "2026-08-08T00:53:08.259662803Z",
        "modified_time": "2026-08-08T00:47:48Z",
        "sha256": "80727943437a7e22116b369c010fc965c4854a0c58a053504c4bc55555e90dd4",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (80727943437a7e22116b369c010fc965c4854a0c58a053504c4bc55555e90dd4)\nOn import, dist/index.mjs chmods 0755 and spawns the bundled Linux x86_64 binary dist/internal/calc-math.dat as a detached background process. The binary is a RedShell-style remote-access implant: it beacons to hardcoded C2 217.60.77.63, executes /bin/sh commands, drops and runs additional ELFs and shellcode fetched from the C2, offers SOCKS5 proxying and TCP port forwarding, installs systemd --user persistence (svc-update.service), and exfiltrates files via POST /api/extract-receive. Implant commands /ssh_keys, /creds, /dbfind, /clipboard, /env, and /dataextract harvest installer-side secrets (SSH private keys, stored credentials, clipboard, environment) and upload them to the same C2 through a chunked BIGEXTRACT upload routine. Package name, README, and inline comments describe the ELF as a \u0027native math accelerator\u0027 for calendar/streak math, but the pure-JS daymath.mjs never invokes the binary; the shipped SHA-256 \u0027integrity check\u0027 (4537b118...3466) pins this specific implant, so it functions as anti-tamper for the payload rather than a security control.\n",
  "id": "MAL-2026-13632",
  "modified": "2026-08-08T00:47:48Z",
  "published": "2026-08-08T00:47:48Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/map-streak-kit/v/1.0.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in map-streak-kit (npm)"
}