The streak-grid-core npm package (version 1.0.0) advertises itself as a dependency-free calendar/streak math utility but contains a malicious payload embedded in its main entry file (index.mjs). This payload concatenates multiple base64-encoded chunks, each starting with the ELF magic marker, decodes them into a binary executable, writes this executable to disk with executable permissions, and then runs it using node's child_process module. The payload is obfuscated by splitting it into multiple strings and using unrelated package names in comments to evade detection. Any project importing this package, directly or transitively (e.g., via svelte-streak-grid), triggers execution of this native code on the installer or build host, posing a severe security risk.

This malicious package enables arbitrary native code execution on the host machine during installation or build time, potentially compromising the system integrity and confidentiality. Since the payload executes with the privileges of the user running the installation, it can lead to full system compromise, data theft, or further malware deployment. The threat affects any environment that installs or builds with this package version.

No official patch or remediation is currently documented for this package version. Users should immediately avoid installing or using streak-grid-core version 1.0.0 and remove it from their dependency trees. Audit and verify all dependencies for malicious code, especially those pulled transitively. Consider using trusted package sources and integrity verification mechanisms. Monitor vendor advisories or repository updates for any official fixes or removals.