The streak-core-bucket npm package version 1.0.0 contains malicious code that, upon import, downloads and executes a remote binary from an obfuscated URL. This behavior is disguised as a benign startup check but actually fetches an opaque executable from an anonymous third-party source and runs it with elevated permissions.