Trojanized npm package spawns bundled ELF (streak-metrics-math/calc-mapping.bin)

Shadows VMB@Vemorian_Mort

•updated Aug 24, 2026•7•0•8

Detects the execution of a binary named 'calc-mapping.bin' (either by image file path or command line arguments) where the parent process is 'node'. This pattern is indicative of a Node.js application spawning an unusual or potentially malicious binary.