streak-int-lib@1.0.0

Analysis

streak-int-lib@1.0.0 is a trojanized npm package posing as a calendar-day and streak-math library. On module import, it automatically decodes a base64-embedded ELF binary (~87KB, linked against OpenSSL) from within index.mjs, writes it to ~/.config/systemd/user/index with executable permissions, and spawns it as a detached background process. The binary is a C2 implant: it uses TLS sockets (SSL_connect, SSL_read, SSL_write) for encrypted command-and-control, performs system reconnaissance (gethostname, uname, getenv, readdir, getpwuid), and can fork/execute additional payloads. The implant was observed attempting DNS resolution to a remote C2 domain. The package's README and public API describe only benign calendar-math functions and make no mention of the background service or binary payload.