Description

The package advertises itself as a dependency-free calendar-day bucketing / streak math library, but its main module dist/index.mjs contains a top-level IIFE that chmod +x's a shipped Linux ELF at dist/internal/calc-cache.bin, verifies its sha256, and spawns it detached via child_process.spawn on any require()/import of the package. The binary is a remote-shell implant (strings include "REDSHELL", "SECURE_BEACON", "RedShell commands:", "/redshell socks start ") that connects to a hardcoded C2 at 217.60.77.63 and awaits operator commands. Once running, the implant exposes commands to (a) download and execute additional ELF binaries and raw shellcode fetched from http:///Others/... and http:///SC/... into /tmp or via memfd_create (syscall 319), (b) harvest SSH keys, credentials, database files, clipboard contents, and arbitrary files, exfiltrating them over a chunked HTTP POST channel to /api/extract-receive with BIGEXTRACT_START/END framing, and (c) install systemd user-unit persistence by writing ~/.config/systemd/user/svc-update.service (Description="System Update Service", Restart=always, ExecStart=/proc/self/exe) and running systemctl --user daemon-reload && enable --now. The ELF is labeled a "Native math accelerator" in the loader, but contains no math functionality — its entire string table is red-team beacon / SOCKS5 proxy / port-forward / shellcode-injection tooling. Importing this package hands remote command execution, credential access, and reboot-persistent access on the installer's host to the C2 operator.

Mitigation

Aliases