Malicious code in streak-calc-metrics (npm)

The npm package streak-calc-metrics@1.0.0 was published with malicious code disguised as a native math accelerator. The package bundles a Linux ELF binary at dist/calc.bin that is automatically executed with elevated privileges when the module is imported, without user consent or visibility.\n\nThe embedded binary, self-identified as 'REDSHELL', establishes a reverse shell connection to hardcoded C2 infrastructure at IP 217.60.77.63. It implements a full remote command shell over /bin/sh and /bin/bash, allowing attackers to execute arbitrary commands on the compromised system.\n\nThe implant includes multiple data exfiltration capabilities: it harvests SSH keys from ~/.ssh, credential files, environment variables, and arbitrary filesystem paths. Stolen data is exfiltrated via HTTP POST requests to the C2 server using markers such as BIGEXTRACT_START and Destination: Loot_*. The malware also downloads and executes additional ELF binaries and shellcode from the C2 server without signature verification.\n\nPersistence is achieved by writing a systemd user service file at ~/.config/systemd/user/svc-update.service configured to restart automatically, ensuring the implant survives system reboots.\n\nThe package was identified via Amazon Inspector and published to the GitHub Advisory Database.