streak-math-metrics@1.0.0

Analysis

streak-math-metrics@1.0.0 is a trojanized package that ships a bundled ELF binary (dist/math-calc.bin) which is a full remote-access trojan. On import, the package spawns the binary as a detached background process. The binary provides: remote shell execution, TCP port forwarding, SSH key theft (from ~/.ssh/), browser credential harvesting (Chrome, Firefox, Brave, Edge — Login Data, Cookies, Local State), database discovery, file exfiltration to hardcoded C2 at 217[.]60[.]77[.]63 and to catbox.moe, and systemd user-service persistence. The binary also performs DNS reconnaissance and system information gathering.