streak-map-kit version 1.0.0 is a malicious npm package that includes a Linux ELF binary (REDSHELL) embedded in dist/internal/calc-mapping.bin. Upon import, the package changes the binary's permissions and spawns it as a detached process. REDSHELL connects to a hardcoded C2 server at http://217.60.77.63 and exposes a comprehensive remote shell interface with commands for system information gathering, file system access, credential theft, process management, user account manipulation, and arbitrary command execution via /bin/sh or /bin/bash. It exfiltrates data including SSH keys and stored credentials in chunked POST requests. The malware fetches and executes second-stage payloads over unencrypted HTTP without verification, using advanced techniques such as memfd_create for fileless execution. Persistence is established through systemd user services, cron jobs, bashrc, and XDG autostart entries. The malware also provides SOCKS5 proxy, TCP port forwarding, and a custom tunneling protocol to facilitate lateral movement within networks. The package's documentation and comments misleadingly claim it performs no side effects and is a high-performance math library, contradicting the actual malicious behavior.

Systems importing streak-map-kit version 1.0.0 on Linux will execute a malicious binary that establishes persistent remote access to an attacker-controlled server. This enables attackers to exfiltrate sensitive data such as SSH keys and credentials, execute arbitrary commands, install additional payloads, and pivot within internal networks. The persistence mechanisms ensure long-term compromise. The presence of network tunneling and proxy capabilities increases the risk of lateral movement and further network exploitation.

No official patch or remediation is currently documented. Users should immediately remove streak-map-kit version 1.0.0 from their projects and environments. Investigate any systems where this package was imported for signs of compromise, including running processes, persistence mechanisms (systemd user services, cron jobs, bashrc, XDG autostart), and network connections to the indicated C2 server. Block network traffic to the hardcoded IP address 217.60.77.63 at network perimeter controls. Monitor for suspicious child processes spawned by node modules. Consider rebuilding affected environments after thorough incident response. Patch status is not yet confirmed — check the vendor advisory or official sources for updates.