Malicious code in streak-metric-test (npm)

The streak-metric-test package version 1.0.0 includes a top-level asynchronous function that, when the package is imported or required, decodes a base64 string array into a binary buffer, writes this binary to a hidden cache directory (~/.cache/streak-metric/h), sets the file permissions to executable (chmod 755), and then launches the binary as a detached background process using child_process.spawn. The supporting functions mislabel this behavior as benign caching, but the full decode-write-execute chain is present. The current payload array is empty (inert), but the code is fully wired to execute arbitrary binaries if the payload is populated. There is no declared legitimate purpose or native addon that would justify this behavior, indicating malicious intent consistent with a staging or test artifact.

If the payload were activated, this could lead to arbitrary code execution on the host system when the package is imported, potentially allowing an attacker to run malicious binaries stealthily in the background. Currently, the payload is inert, so no active exploitation is occurring. However, the presence of this fully implemented dropper mechanism poses a significant risk if the payload is populated or modified.

Since this is a malicious package, the primary mitigation is to avoid using [email protected] and remove it from any environments where it is installed. No official patch or fix is available. Users should audit their dependencies and ensure they do not include this package. Monitor for any unexpected binaries in the ~/.cache/streak-metric directory and remove them if found.