The npm package streak-grid-core version 1.0.0 contains malicious code that executes native code on the host machine during installation or build. The package's main entry point dynamically reconstructs and executes a base64-encoded ELF binary via child_process, enabling arbitrary code execution. This behavior is hidden by splitting the payload into multiple string chunks and using misleading comments referencing unrelated package names.