Malicious code in streak-cal-core (npm)

The npm package streak-cal-core was published with malicious code in its main entry point (index.mjs). The module contains a ~500 KB base64-encoded x86-64 ELF binary stored in a _store array, disguised with a // --- Calibration Data --- comment.\n\nOn import, the module automatically decodes the base64 payload, writes the binary to disk with executable permissions (mode 0o755), dynamically imports node:child_process, and executes the dropped binary. This behavior triggers as a top-level import side effect, meaning any consumer that requires or imports the package will execute the embedded native code without additional user action.\n\nThe package exhibits characteristics of a typosquat attack: the file header labels the module streak-larq-hydration and references svelte-insight-hydration, while the published package name is streak-cal-core with a README pointing to svelte-streak-cal. This naming mismatch is consistent with a family of sibling typosquat variants. The advertised purpose (a dependency-free calendar/streak math helper) is inconsistent with shipping and executing an opaque native binary.\n\nThe incident was identified and reported by the OpenSSF malicious-packages project.