The 'streak-view-core' npm package (version 1.0.0) includes an 'index.mjs' file containing an array of base64-encoded string chunks. When imported, the package decodes these chunks into a Linux ELF binary, writes it to a temporary file, and executes it using 'child_process.spawn'. The ELF binary references '/lib64/ld-linux-x86-64.so.2', indicating it is a native Linux executable. This execution occurs without user consent or justification related to the package's advertised functionality, indicating malicious intent. The payload is deliberately fragmented to obscure the ELF header and evade casual inspection.

Any system that imports and runs the 'streak-view-core' package version 1.0.0 will execute an unauthorized native Linux binary, potentially allowing arbitrary code execution on the host. This compromises system integrity and security, as the binary runs with the privileges of the importing process. The exact malicious actions of the ELF binary are not detailed, but executing unknown native code poses significant risk.

No official patch or remediation is currently documented. Users should immediately avoid installing or importing 'streak-view-core' version 1.0.0. Remove the package from any affected environments and audit systems for unauthorized execution of native binaries. Monitor for updates or advisories from the package maintainers or npm registry regarding this issue. Since this is a malicious package, consider using trusted package sources and verifying package integrity before use.