Importing the package root executes a bundled ELF in a detached process. The ELF exposes remote-control, credential-harvesting, payload-execution, persistence, and exfiltration functionality.
Static reason
No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Any runtime import of kit-map-streak's root export.
Impact
Remote code execution, credential and data exfiltration, proxy/tunneling, and user-level persistence.
Mechanism
Import-time detached execution of a bundled RedShell-style ELF backdoor.
Attack narrative
At package import, dist/index.mjs makes the disguised ELF executable, validates its pinned hash, and launches it detached. Static strings in that ELF identify a RedShell backdoor with C2 payload downloading, memfd/shellcode execution, SOCKS and port-forwarding, SSH/browser/database credential collection, uploads, and systemd/autostart persistence.
Rationale
The benign-looking date API is a wrapper around intentional import-time execution of a bundled backdoor binary. No install hook is needed because ordinary application imports activate it.
Evidence
package.jsondist/index.mjsdist/internal/calc-math.datdist/internal/daymath.mjsdist/store.mjs~/.ssh/root/.ssh/home/*/.ssh/etc/ssh~/.config~/.config/systemd/user~/.config/autostart