The streak-metricsa npm package at version 1.0.0 embeds a base64-encoded Linux x86-64 ELF binary within its main module. Upon import or require, the package reconstructs this binary, writes it to disk, sets executable permissions, and executes it using Node.js child_process. The binary's dynamic symbols indicate it functions as a TLS-based remote-command implant with capabilities such as SSL/TLS communication, socket operations, dynamic library loading, process creation, and shell command execution. The package's README falsely claims the top-level behavior is a 'tiny startup self-check', which conceals the malicious implant execution.

Any system that imports or requires the [email protected] package will execute a native implant capable of outbound TLS communication and shell command execution. This can lead to unauthorized remote control of the host system, data exfiltration, and further compromise. The implant's presence can severely impact system confidentiality, integrity, and availability.

No official patch or remediation is currently available. Users should immediately remove and avoid using [email protected]. Audit dependencies for this package and replace it with trusted alternatives. Monitor for any signs of compromise on systems where this package was used. Check vendor advisories or trusted security sources for updates or fixes.