MAL-2026-14222 Malicious code in streak-cal-core (npm)

index.mjs (the package's main entry) contains a ~500 KB base64-encoded x86-64 ELF payload stored in a _store array disguised with a // --- Calibration Data --- comment. On import, the module joins the base64 chunks, writes the decoded bytes to disk with mode 0o755, dynamically imports node:child_process, and executes the dropped binary. The behavior fires as a top-level import side effect, so any consumer that requires or imports the package runs the embedded native code. The file's header comment labels the module streak-larq-hydration and references svelte-insight-hydration, while the package is published as streak-cal-core with a README pointing at svelte-streak-cal — internal naming does not match the published identity, consistent with a family of sibling typosquat variants. The advertised purpose (dependency-free calendar/streak math helper) is inconsistent with shipping and executing an opaque native binary.