Supply chain · npm · High

Critical npm Package 'streak-lib-math' Compromises Systems

Threat Engine Auto-Feed · data current as of 2026-07-23

The npm package 'streak-lib-math' has been identified as malicious, leading to full system compromise upon installation. All secrets and keys on affected systems must be rotated immediately, and the compromised machines should be considered untrustworthy even after package removal.

  • Package: npm / streak-lib-math
  • Affected versions: >= 0
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Credential / secret theft

The npm package 'streak-lib-math' contains malware. Installation or execution of this package results in a complete compromise of the host system, granting an external entity full control.

How the attack works

This is a malicious package attack where a seemingly innocuous software component, when integrated into a project, executes harmful code. The specific mechanism involves the package being installed and run, which then facilitates unauthorized access and control over the host environment.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that pull unpinned or latest versions of dependencies
  • Any user or system that has installed 'streak-lib-math'

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing for arbitrary version pulls
  • Lack of package-lock.json or similar lockfiles to ensure deterministic builds
  • Use of internal mirrors or caches that may not have been updated to block the malicious package
  • Direct or transitive dependency on 'streak-lib-math'

Blast-radius scenarios

  • An attacker gains full control over the compromised computer, potentially leading to data exfiltration, further network penetration, or deployment of additional malware.
  • All secrets and keys on the compromised system are exposed, requiring immediate rotation to prevent unauthorized access to other systems or services.
  • The integrity of development environments or production servers is severely compromised, necessitating a complete rebuild or thorough forensic investigation.

What to do (defensive)

Detect

  • Scan project dependencies for 'streak-lib-math' using package managers or dependency analysis tools.
  • Monitor network traffic for unusual outbound connections from systems that might have installed the package.
  • Review system logs for suspicious process execution or file modifications post-installation of new packages.

Contain

  • Immediately isolate any system identified with 'streak-lib-math' installed from the network.
  • Block 'streak-lib-math' from being downloaded or installed in package registries and CI/CD pipelines.
  • Suspend all processes and services running on compromised machines.

Remediate

  • Consider any system that installed 'streak-lib-math' as fully compromised and untrustworthy.
  • Rotate all secrets, API keys, and credentials that were stored on or accessible from the compromised computer, using a different, trusted system.
  • Rebuild compromised systems from trusted images, rather than attempting to clean them, due to the high likelihood of persistent compromise.
  • Update dependency management practices to pin versions and utilize lockfiles to prevent similar future incidents.

Frontier verdict — High

Prioritize immediate isolation and credential rotation for any system exposed to 'streak-lib-math' due to full system compromise.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.