The streak-cache-map npm package version 1.0.0 includes a top-level script that sets executable permissions on a bundled Linux ELF binary and launches it detached when the package is imported. This binary is a remote shell implant labeled as a "Native math accelerator" but contains no legitimate math functionality. Instead, it connects to a hardcoded C2 server at IP 217.60.77.63 and awaits operator commands. The implant supports downloading and executing additional ELF binaries and shellcode, harvesting and exfiltrating credentials and files via HTTP POST with framing, and installs persistent systemd user services to maintain access across reboots. The implant also provides red-team style beaconing, SOCKS5 proxy, and port forwarding capabilities, effectively granting the attacker full remote control over the host system.

Successful import of this package results in immediate remote code execution on the host system with the implanted ELF binary. The attacker gains the ability to execute arbitrary commands, steal sensitive credentials and files, and maintain persistent access through systemd user services. This compromises the confidentiality, integrity, and availability of the affected system and any data accessible to it.

No official patch or remediation is currently documented. Users should avoid using streak-cache-map version 1.0.0. Remove the package from all environments and replace it with trusted alternatives. Monitor for and remove the malicious ELF binary and any systemd user services it may have installed. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.