Malicious code in streak-grid-core (npm)

__

Source: amazon-inspector (b40df62bf7b6dcc3bc33d5b2b876ea57e4f355dd326f48ec7a6d3750fa6148d7)

The package advertises itself as dependency-free calendar/streak math primitives, but the main entry (index.mjs, resolved via package.json exports ".") contains a top-level 'Background sync' block that concatenates a large array of base64 chunks (each beginning with the ELF magic marker 'f0VMRg' = \x7fELF), decodes the result with Buffer.from(..., 'base64'), writes it to disk with mode 0o755, and executes it via a dynamically imported node:child_process. Any consumer that imports this module (including transitively via svelte-streak-grid referenced in the README) triggers native code execution on the installer/build host. The payload is split across multiple quoted string chunks and joined at runtime to evade simple string scanners, and file header comments reference unrelated package names ('streak-larq-hydration', 'svelte-insight-hydration') that do not match the published name, consistent with cover-story framing.