Importing the package root starts the bundled ELF binary in the background. The binary is a remote-control payload with credential theft, remote execution, proxying, exfiltration, and persistence capabilities.
Static reason
No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Any runtime import of streak-calc-metrics root entrypoint.
Impact
Remote code execution, credential/data theft, network tunneling, and persistence on the importing host.
Mechanism
import-time detached execution of a malicious bundled ELF backdoor
Attack narrative
The root module chmods and detached-spawns calc.bin during import, despite its advertised streak-math purpose. Static strings in the verified ELF expose a RedShell backdoor: remote payload retrieval and execution, shellcode/memfd execution, SOCKS and port-forwarding, credential collection, archive upload, and multiple persistence methods. This is concrete malicious behavior activated by normal package use.
Rationale
The benign JavaScript math functions are a cover for an import-time execution path that launches a bundled backdoor. No lifecycle script is needed because normal import activates the payload.
Evidence
package.jsondist/index.mjsdist/calc.bindist/internal/daymath.mjsdist/store.mjs~/.ssh~/.config~/.bashrc