streak-kit-map @1.0.0

Summary

The package advertises itself as a streak/calendar math library, but its main entry dist/index.mjs contains a top-level IIFE that, on any import / require , chmods dist/internal/map-calc.bin to 0755 and detached-spawns it after a sha256 integrity gate. The bundled Linux x86_64 ELF is a full remote-control implant: strings show a RedShell / RC2TUN beacon to a hardcoded C2 at 217.60.77.63, command handlers for shell execution, ELF/shellcode download-and-run (including memfd_create fd exec) via HTTP paths /Others/<file> and /SC/<file> , SOCKS5 proxy and port forwarding, chunked file exfiltration via POST /api/extract-receive HTTP/1.1 packaging loot as Loot_<host>_<user>_<ts> , targeted collection of SSH keys and credentials ( /ssh_keys , /creds , /dbfind , /download , /dataextract ), and reboot persistence by writing ~/.config/systemd/user/svc-update.service (Description=System Update Service, Restart=always) and enabling it via systemctl --user . The JS wrapper's Loads the native math accelerator / integrity verification — critical security gate comments are cover-story framing; the hash pin exists to guarantee the exact malicious bytes execute.

Source: amazon-inspector (18948f1c8e71b24d05e1ef6f749995bdc9098d610f791b86dc33f7d41dd8b1d3)