Hostile 100% javascript Download

streak-math-metrics 1.0.0

Bundled RedShell backdoor binary

Beacon uses framed protocol and tuned TCPCommand agent exposes ELF and shellcode injection
SHA-25667106c54d7e0c3b3bc53012da9159e4db72f2c780dccfb73b425536a3d378d00
URLhttps://registry.npmjs.org/streak-math-metrics/-/streak-math-metrics-1.0.0.tgz
MaleculeK₂(McLi)O₈(C₃Ca₃Er₃EuS₂P₅XeDy₂)H₇(Cm₂₃Cr₃Db₆Ds₃F₁₄Os₁₃Po₁₅)Md₄(Bi₂InPa₃)Th

Also flagged by osv (MAL-2026-12000: Malicious code in streak-math-metrics (npm)) +3 more.

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.