streak-calc-metrics@1.0.0

Analysis

streak-calc-metrics@1.0.0 ships a native Linux ELF (dist/calc.bin) that is executed on package import via a detached child process. The binary is a full remote-access implant ("redshell"): it beacons to C2 host 217[.]60[.]77[.]63, downloads and executes remote ELF and shellcode payloads from /Others/ and /SC/ paths over HTTP, provides a port-forward and tunnel facility, and installs persistence by writing a systemd user service (svc-update.service) that runs on login. It also POSTs extracted data to an /api/extract-receive endpoint and resolves the public IP via api[.]ipify[.]org. The JS wrapper (dist/index.mjs) spawns the binary detached with stdio piped to /dev/null on import, so merely importing the package launches the implant.