streak-metric-testnpm
streak-metric-test is a confirmed malicious npm package (MAL-2026-14224) that executes malicious code on install (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in streak-metric-test (npm)
What this malware does
[email protected] ships a fully wired dropper that fires on import/require of the package root. The top-level async IIFE in dist/index.mjs assembles a Buffer from a base64 string array, writes it to ~/.cache/streak-metric/h, chmods it 0o755, and detach-spawns it via child_process.spawn(..., { detached: true, stdio: 'ignore' }).unref(). The supporting primitives (ensureDir, writeBinary, runDetached) live in dist/internal/daymath.mjs alongside unrelated day-math helpers, with docstrings ("Start a background task", "Save data to cache") that mislabel the chmod-executable + detached-spawn behavior as benign caching. The payload array is currently [""] (inert), but the decode→write→chmod+x→detached-spawn chain is complete and only requires populating one string to arm; the package name suffix -test, the cover-story comments, and the hidden cache path are consistent with a staging artifact rather than legitimate functionality. No native addon, no declared purpose that would justify writing and executing an opaque binary from an in-source blob at import.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for streak-metric-test (version 1.0.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging streak-metric-test across your stack and pipelines.
If you installed it — respond
Remove streak-metric-test from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If streak-metric-test was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks streak-metric-test before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks streak-metric-test-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.