The streak-metric-core npm package version 1.0.0 contains malicious code that executes arbitrary binaries on the host system upon import. The package reconstructs a URL at runtime to download an opaque binary from an anonymous Backblaze B2 bucket, saves it to the user's cache directory, makes it executable, and runs it detached without any integrity verification. This behavior occurs unconditionally during module load, enabling the package author to execute arbitrary code on the installer's machine.