Importing the package root executes a bundled ELF payload. The payload includes credential collection, remote download-and-execute, data exfiltration, tunneling, and persistence capabilities.
Static reason
No blocking static signals were detected.
Trigger
Any runtime import of streak-cache-map.
Impact
Host compromise, credential theft, remote code execution, persistence, and data exfiltration.
Mechanism
Import-time detached execution of a malicious native binary.
Attack narrative
On import, dist/index.mjs makes the bundled ELF executable and launches it detached after validating its pinned hash. Static strings in that ELF show commands to harvest SSH keys and browser credential stores, download and execute ELF or shellcode payloads, establish tunnels, upload collected data, and create cron/bashrc/systemd/XDG persistence.
Rationale
The package’s public JavaScript math functions are a facade for an import-time native backdoor. The pinned hash verifies the malicious binary rather than mitigating it.
Evidence
package.jsondist/index.mjsdist/internal/calc-cache.bindist/internal/daymath.mjsdist/store.mjs~/.ssh/root/.ssh/home/*/.ssh/etc/ssh~/.config~/.mozilla/firefox~/.bashrc~/.config/systemd/user/svc-update.service