The [email protected] npm package embeds a base64-encoded x86-64 ELF binary within its configuration data. When the module is imported, it decodes this binary, writes it to ~/.config/systemd/user/index with executable permissions, and launches it as a detached background process that persists beyond the Node.js process lifecycle. The binary contains symbols related to TLS and networking (e.g., SSL_write, SSL_connect), indicating it can perform network operations. This is inconsistent with the package's declared calendar-math functionality and the misleading comments claiming no network or filesystem side effects. This behavior constitutes a malicious package that installs a persistent, network-capable background service without user consent.

The malicious code can execute arbitrary native code on the host system with user-level permissions, establish persistent presence via systemd user services, and perform network communications potentially for command and control or data exfiltration. This undermines system integrity and confidentiality. There are no known exploits in the wild reported yet, but the presence of a hidden network-capable binary poses a significant risk if deployed.

No official patch or remediation is currently documented. Users should avoid using streak-int-lib version 1.0.0. Remove the package and any related files from ~/.config/systemd/user/index to eliminate the persistent background binary. Monitor for suspicious processes spawned by Node.js modules. Check vendor or repository advisories for updates or removal notices. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.