Malicious code in streak-cal-core (npm)

The streak-cal-core npm package version 1.0.0 includes a ~500 KB base64-encoded x86-64 ELF payload embedded in its main entry file (index.mjs) within a disguised array. Upon import, the module decodes this payload, writes it to disk with executable permissions, dynamically imports the node:child_process module, and executes the binary. This execution occurs as a top-level side effect, meaning any consumer importing or requiring the package will run the embedded native code. The internal naming conventions and README references differ from the published package name, consistent with typosquatting tactics. The package's advertised purpose as a dependency-free calendar/streak math helper is inconsistent with the presence and execution of this opaque native binary.

Any application or developer importing or requiring streak-cal-core version 1.0.0 will inadvertently execute a large native binary payload, potentially leading to arbitrary code execution on the host system. This compromises system integrity and security, as the payload behavior is opaque and not aligned with the package's stated functionality. There is no indication of known exploits in the wild at this time.

No official patch or remediation is currently available. Users and developers should avoid installing or importing the streak-cal-core package version 1.0.0. Remove any existing installations of this package from projects and dependency trees. Monitor for updates or advisories from the npm registry or package maintainers regarding this malicious package. Consider using trusted and verified packages for calendar or streak-related functionality.