The streak-math-calc npm package version 1.0.0 includes a top-level immediately-invoked function expression (IIFE) in its main entry point that changes permissions and executes a bundled ELF binary (dist/math-calc.bin). This binary functions as a remote-access implant, beaconing to IP 217.60.77.63 to download further ELF files and shellcode, executing arbitrary shell commands, and harvesting sensitive information such as SSH private keys, stored credentials, and database configurations. It exfiltrates collected data via HTTP POST requests to its command-and-control infrastructure and an additional exfiltration endpoint at litterbox.catbox.moe. Persistence is achieved by creating a systemd user service named 'System Update Service' that restarts the implant on reboot. The package description misleadingly frames itself as a 'math accelerator' without disclosing the malicious ELF or its execution on import.

Any system with streak-math-calc version 1.0.0 installed or running is fully compromised. The implant provides attackers with remote control, enabling them to execute arbitrary commands, steal sensitive credentials including SSH keys and database configurations, and maintain persistence across reboots. This compromises the confidentiality, integrity, and availability of the affected system and any connected resources. Secrets and keys stored on the compromised system should be considered exposed and rotated immediately from a secure environment.

Remove the streak-math-calc package version 1.0.0 immediately from all affected systems. Assume full compromise of the system and perform a thorough incident response including credential rotation from a separate, secure device. There is no known patch or official fix for this malicious package; remediation relies on removal and recovery procedures. Monitor for any persistence mechanisms such as the systemd user service 'svc-update.service' and remove them. Verify that no additional malicious binaries or backdoors remain on the system.