The 'streak-map-cache' npm package (version 1.0.0) advertises itself as a dependency-free day/streak math library but includes a malicious Linux ELF binary (dist/internal/calc-map.bin) executed on every import. This binary acts as a RedShell C2 implant, beaconing to a hardcoded IP (217.60.77.63) over plain HTTP. It accepts shell commands, implements reverse shell, SOCKS5 proxy, TCP port forwarding, and supports downloading and executing ELF/shellcode payloads. It also facilitates chunked file exfiltration and operator commands for harvesting SSH keys, credentials, databases, environment variables, clipboard data, and arbitrary downloads. Persistence is maintained via systemd --user services. The binary is disguised as a 'native math accelerator' to mislead reviewers. The pure JavaScript logic does not invoke the binary, which is cosmetic but malicious.

Systems with this package installed are fully compromised, as the malicious binary provides remote attackers with full control, including command execution, data exfiltration, credential theft, and persistence. Secrets and keys stored on affected systems are at high risk and should be considered compromised.

Immediate removal of the 'streak-map-cache' package version 1.0.0 is required. However, because the malicious binary grants full system control to attackers, removal alone may not eliminate all backdoors or malware. It is critical to rotate all secrets and credentials from a trusted environment. Conduct a thorough forensic investigation and consider rebuilding affected systems to ensure complete remediation. No official patch or fix is available; the package should be considered malicious and untrusted.