MAL-2026-11388

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6a3508138a215de5140d5c7922b41c602866a034ab1e8b28076f2cb734256844)

The package advertises itself as a dependency-free calendar/streak math library but its main entrypoint dist/index.mjs contains a top-level IIFE that, on import, spawns the bundled ELF dist/math-calc.bin as a detached child process. The binary is a full-featured C2 implant, not a math accelerator: it beacons to a hardcoded operator at 217.60.77.63 over TLS and exposes command handlers (/redshell, /portfwd, /socks, /spawn) that pipe network-supplied input into /bin/bash and /bin/sh, giving the remote operator interactive shell control of the installer's machine. The implant additionally exposes /ssh_keys, /creds, /dbfind, /clipboard, /env, and /users commands that harvest SSH keys, saved credentials, clipboard contents, environment variables, and user accounts; a /dataextract flow (BIGEXTRACT) that walks arbitrary filesystem paths and POSTs chunked file contents to /api/extract-receive on the operator's server in named Loot_ collections; a /persist command that writes ~/.config/systemd/user/svc-update.service pointing ExecStart at /proc/self/exe and runs systemctl --user daemon-reload && enable --now for reboot persistence (with cron/bashrc/xdg variants); and a memfd_create-based stager (/stage, /dlopen, /redshell elf) that fetches follow-on ELFs and shellcode from the operator's HTTP server (Others/, SC/) and executes them fileless. A daymath.mjs stub contains a comment stating it 'makes the math functions look like they rely on the binary', confirming the math library framing is a cover story for the implant.

Source: ghsa-malware (a913fd5a875b9f4d9e28f9dad275141e725aa3ed6c2709d7c3744fa998264443)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package...