streak-map-kit@1.0.0

Analysis

streak-map-kit@1.0.0 is a trojanized "streak math" library. Importing the package root evaluates dist/index.mjs, which chmods and spawns a bundled 63KB ELF binary (dist/internal/calc-mapping.bin) as a detached background process, disguised as a "native math accelerator" behind a fake integrity check. The ELF is a full remote-access implant that connects to C2 host 217[.]60[.]77[.]63. It provides: /redshell and /stage to download and execute second-stage ELF/shellcode payloads from hxxp://217[.]60[.]77[.]63:<port>/Others/<file> and /SC/<file>; /creds which copies browser credential stores (Chrome/Chromium/Brave/Edge/Firefox Login Data, Cookies, Local State, logins.json, key4.db); /ssh_keys which harvests SSH private keys and authorized_keys; /dbfind which greps database configs and password files; /persist which installs persistence via cron, ~/.bashrc, and a systemd user service; /tunnel (RC2TUN), /portfwd, and /socks for network pivoting; /memfd and /shellcode for in-memory payload execution; /adduser and /enableuser for creating/enabling local accounts; and recon via /sysinfo, /env, /ps, /ifconfig, /netstat, /users. Stolen data is exfiltrated to litterbox.catbox.moe and via POST /api/extract-receive. The implant also resolves the host's public IP via api[.]ipify[.]org.