streak-math-calc@1.0.0

Analysis

streak-math-calc@1.0.0 ships a native ELF binary (dist/math-calc.bin) that is executed automatically on package import via a detached child process. The binary is a remote-access trojan: it beacons to a C2 server at 217[.]60[.]77[.]63 (HTTP paths /Others/ and /SC/ for downloading and executing payloads), provides a reverse shell with memfd injection, SOCKS proxy, port forwarding, and a tunnel. It harvests SSH private keys from ~/.ssh, /root/.ssh, /home/*/.ssh and /etc/ssh; steals browser credentials (Chrome/Chromium/Brave/Edge Login Data, Cookies, Local State and Firefox logins.json/key4.db); enumerates database credentials from mysql/postgres/mongo/redis configs, .pgpass, .my.cnf and DB-related environment variables; dumps environment variables; and exfiltrates collected files to the litterbox.catbox.moe file-upload API. It establishes persistence via cron, .bashrc, and a systemd user service. The package's advertised math functions are implemented in pure JavaScript and do not require the binary.