The npm package streak-metricsa version 1.0.0 contains malicious code that drops and executes a native Linux x86-64 ELF binary on any import or require. This binary acts as a remote-command implant using TLS for communication and has capabilities including shell execution and network communication. The package disguises this behavior as a harmless calendar-day math helper, misleading users. Any project importing this package risks executing this implant on the host system.