The streak-core-bucket npm package (version 1.0.0) includes a top-level asynchronous immediately-invoked function expression (IIFE) that decodes a reversed base64 string to reveal a URL pointing to a third-party storage bucket. Upon import, it downloads the binary from this URL, writes it to a local cache directory with executable permissions (0o755), and spawns the binary detached from the parent process, ignoring standard input/output streams. The download URL is deliberately obfuscated to evade casual detection. This behavior is framed misleadingly as a benign self-check but effectively executes arbitrary remote code on any require or import of the package.

Any system that imports or requires the streak-core-bucket package version 1.0.0 will execute a remote binary from an untrusted source without user consent or verification. This can lead to arbitrary code execution, potentially compromising system integrity, confidentiality, and availability. The malicious binary is opaque, and its exact payload is unknown from the provided data, but the execution of remote code inherently poses a high security risk.

No official patch or remediation is currently documented. Users should immediately avoid using streak-core-bucket version 1.0.0 and remove it from their projects. Since the package executes remote code on import, it should be considered untrusted and blocked from use. Monitor for updates from the package maintainer or npm advisories for any official fixes or removals. Until then, do not import or require this package in any environment.