streak-view-core@1.0.0

Analysis

Package streak-view-core@1.0.0 is a trojanized npm package that drops and executes a C2 binary on import. The package masquerades as a calendar-day bucketing library but contains a base64-encoded ELF x86-64 binary embedded in index.mjs. On module import, an immediately-invoked function dynamically imports node:child_process, node:fs, node:os, and node:path. It first checks /etc/hostname for the string 'ubuntu-fc-uvm' and exits silently if detected. Otherwise, it decodes the embedded binary, writes it to ~/.cache/svc/index with executable permissions, and spawns it as a detached background process. The dropped binary links against OpenSSL (libssl.so.3, libcrypto.so.3) for encrypted command-and-control and contains symbols for SSL_connect, SSL_write, SSL_read, gethostbyname, gethostname, getenv, popen, execve, fork, pthread_create, pthread_detach, kill, uname, getcwd, readdir, opendir, bind, listen, and accept — indicating a full C2 implant with encrypted communications, process execution, file system enumeration, and network listener capabilities.