streak-grid-core@1.0.0

Analysis

streak-grid-core@1.0.0 is a trojanized package masquerading as a calendar-day and streak-math utility library. On import, it decodes a base64-embedded ELF binary and writes it to ~/.cache/svc/index, then spawns it as a detached background process. The ELF binary is a full C2 backdoor: it imports SSL/TLS (SSL_connect, TLS_client_method), socket/connect/DNS resolution (gethostbyname, connect, socket), process control (fork, execve, kill, pthread_detach), and file-system reconnaissance (readdir, stat, getcwd, uname, getenv). At runtime the binary attempted a DNS query to a remote host, confirming active C2 beaconing. The binary is dropped to the installer's home directory under .cache/svc/ and persists as a background process.