streak-metrics-math@1.0.1

Analysis

The package masquerades as a calendar-day streak math library but bundles a full C2 implant as a native ELF binary (dist/math-calc.bin). On import, dist/index.mjs spawns the binary as a detached background process. The binary is a remote access trojan (RAT) that: harvests browser credentials (Chrome/Chromium/Brave/Edge/Firefox Login Data, Cookies, Local State), SSH private keys, and database configuration files; performs system reconnaissance (uname, id, ps, env, network interfaces, routing tables, ARP cache, active connections); provides a remote shell with file upload/download/execution; exfiltrates stolen data to catbox.moe (litterbox.catbox.moe) and to a hardcoded C2 server at 217[.]60[.]77[.]63 via HTTP paths /Others/ and /SC/; supports port forwarding, SOCKS proxy, and RC2TUN tunnel protocol; establishes persistence via cron, .bashrc, and systemd user services; and can stage and execute additional payloads from the C2 server.