The streak-metric-core package (npm ecosystem) version 1.0.0 includes malicious functionality where its main entry point reconstructs a URL from obfuscated character codes to download a binary from an anonymous Backblaze B2 storage. This binary is saved to ~/.cache/streak-metric/service, its permissions are set to executable, and it is spawned detached with a randomized delay. There is no hash or signature verification of the downloaded binary, and the URL is obfuscated to avoid detection. This results in arbitrary code execution on any host that imports the package, effectively compromising the system at import time.

Arbitrary code execution on the host system occurs immediately upon importing the package, allowing the attacker to run any code with the privileges of the importing user. This can lead to full system compromise, data theft, persistence, or further malicious activities. The lack of integrity checks and use of an anonymous storage location increases the risk and difficulty of detection.

No official patch or remediation is currently available. Users should avoid installing or importing streak-metric-core version 1.0.0. Remove the package if already installed and scan affected systems for the presence of the downloaded binary at ~/.cache/streak-metric/service. Monitor for suspicious processes spawned from this location. Check vendor advisories or trusted security sources for updates or fixes before considering reinstallation.