The streak-kit-map npm package (version 1.0.0) includes a top-level immediately-invoked function expression (IIFE) in its main entry point that modifies permissions on a bundled ELF binary and executes it after verifying its SHA256 hash. The ELF binary is a remote-control implant with capabilities including beaconing to a hardcoded C2 server (217.60.77.63), executing shell commands, downloading and running ELF or shellcode payloads via HTTP endpoints, SOCKS5 proxy and port forwarding functionality, chunked file exfiltration through a specific HTTP POST endpoint, targeted collection of SSH keys and credentials, and persistence by installing a systemd user service. The package's claims of providing a native math accelerator and integrity verification are deceptive cover stories to mask the malicious behavior.

This malicious package enables an attacker to gain persistent remote control over affected Linux x86_64 systems where the package is installed and imported. The attacker can execute arbitrary shell commands, download and execute additional payloads, proxy network traffic, exfiltrate sensitive files including SSH keys and credentials, and maintain persistence through systemd user services. This represents a severe compromise of confidentiality, integrity, and availability on affected hosts.

No official patch or remediation is currently documented. Users should immediately remove the streak-kit-map package version 1.0.0 from their environments and avoid importing or requiring it. Conduct a thorough investigation of affected systems for signs of compromise, including the presence of the malicious ELF binary and systemd persistence service. Monitor for suspicious network connections to the hardcoded C2 IP address 217.60.77.63. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.