streak-cache-map@1.0.0

Analysis

The package ships a 63KB Linux ELF binary (dist/internal/calc-cache.bin) that is a remote-access trojan. On import, dist/index.mjs chmods and spawns the binary as a detached background process under a fake "native accelerator" cover story. The binary implements a reverse shell and shellcode/ELF downloader that fetches and executes payloads from hxxp://217[.]60[.]77[.]63/Others/ and hxxp://217[.]60[.]77[.]63/SC/, plus port-forwarding, SOCKS proxy, and tunnel modules. It harvests SSH private keys and authorized_keys from ~/.ssh and /etc/ssh, browser credentials (Chrome/Edge/Brave Login Data, Cookies, Local State; Firefox logins.json and key4.db), and database credentials (.pgpass, .my.cnf, DB config files, DB-related env vars). It installs persistence via cron, .bashrc, and a systemd user service (svc-update.service). It exfiltrates collected files by POSTing them to hxxps://litterbox[.]catbox[.]moe/resources/internals/api[.]php and to a POST /api/extract-receive endpoint. C2 host 217[.]60[.]77[.]63.