MAL-2026-13628

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2790159028b31b656c9e704c3a0e4b1a5d114042e0d92c601d133057f760b537)

streak-map-kit is advertised as a dependency-free calendar-day/streak math library but ships a Linux ELF at dist/internal/calc-mapping.bin framed as a 'native math accelerator'. The main entry's top-level async IIFE chmods the ELF to 0755 and spawns it as a detached child process whenever the module is imported, so any consumer that requires the package on Linux drops the binary as a running process. The ELF (internally named REDSHELL) beacons to a hardcoded C2 at http://217.60.77.63 and implements a full remote-shell command surface: /sysinfo, /ps, /env, /ls, /cat, /download, /upload, /sshkeys, /creds, /dbfind, /clipboard, /kill, /spawn, /adduser, /enableuser, /sessions, with unmatched input executed via /bin/sh or /bin/bash. It exfiltrates arbitrary filesystem paths and harvested SSH keys and stored credentials via chunked POSTs to http://217.60.77.63/api/extract-receive (BIGEXTRACTSTART, Loot_%s_%s_%s tagging). Second-stage payloads are fetched from http://217.60.77.63/Others/ and http://217.60.77.63/SC/ over plaintext HTTP with no verification, staged in /tmp, and executed; a memfd_create-based fileless-exec path via a python3 syscall(319) trampoline and /dlopen and /stage commands provide arbitrary further code loading. Persistence is installed by writing ~/.config/systemd/user/svc-update.service (Description='System Update Service', ExecStart=/proc/self/exe, Restart=always) and enabling it via systemctl --user, with cron, bashrc, and xdg autostart alternatives. The beacon also offers a SOCKS5 proxy, arbitrary TCP port-forwarding, and an RC2TUN tunneling protocol that spawns /bin/bash, turning the host into a pivot into reachable internal networks. Cover-story framing (comments describing a 'high-performance streak computation engine', a hardcoded sha256 'integrity verification — critical security gate', a 'Native accelerator loaded and verified' log line, and a README claim that the module performs no side effects on import) is inconsistent with the shipped ELF and the import-time spawn.