calendar-streak-corenpm
calendar-streak-core is a confirmed malicious npm package (MAL-2026-12345) that executes malicious code on install (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in calendar-streak-core (npm)
What this malware does
[email protected] is advertised as a dependency-free calendar-day and streak math library, but index.mjs embeds a hex-encoded Windows PE executable (MZ header) in a _bin string array together with a hex-encoded destination path that decodes to %AppData%/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe. A _decode helper (Buffer.from(h,'hex').toString()) and a block labeled 'Decode and write embedded payload' execute at top-level module import, dropping the executable into the per-user Startup folder so it runs on every subsequent Windows logon. In-code comments claim the module 'touches no network and no filesystem' while the code performs exactly that. Both the payload bytes and the destination path are stored as split hex fragments joined at runtime to evade string-level inspection, and the shipped module is ~500KB dominated by the encoded PE, which is inconsistent with the advertised calendar-math scope. Any project on Windows that imports (directly or transitively) this package gains persistent execution of the embedded binary at logon.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for calendar-streak-core (version 1.0.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging calendar-streak-core across your stack and pipelines.
If you installed it — respond
Remove calendar-streak-core from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If calendar-streak-core was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks calendar-streak-core before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks calendar-streak-core-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.