map-streak-kit@1.0.0

Analysis

map-streak-kit@1.0.0 ships a 63KB Linux ELF binary (dist/internal/calc-math.dat) that is executed on module import by dist/index.mjs, which chmods the file and spawns it as a detached background process. The binary is a remote-access implant ("redshell"): it beacons to C2 at 217[.]60[.]77[.]63 with a SECURE_BEACON payload, downloads and executes second-stage payloads from hxxp://217[.]60[.]77[.]63/Others/ and shellcode from hxxp://217[.]60[.]77[.]63/SC/, provides a /redshell command shell with elf/bin download-and-inject, a /portfwd and /tunnel (RC2TUN) relay, and an exfiltration POST to /api/extract-receive. It performs IP discovery via api[.]ipify[.]org and 8[.]8[.]8[.]8, and installs persistence via a systemd user service (svc-update.service) with configuration under ~/.config/.rsvc. The package's daymath.mjs functions are pure-JS decoys that never call the binary; the "native math accelerator" is a cover for the implant.