registry / Persistence / calmora
calmora
Calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for veldora.
This report shows the evidence for calmora@1.0.1. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms concrete import-time remote payload delivery and Startup-folder persistence, inconsistent with the documented calendar utility. This is malicious behavior, not a noisy static hint.
Static reason
No blocking static signals were detected.
Trigger
Importing calmora when NODE_ENV is not production, process.platform is linux, and /mnt/c exists.
Impact
A remote payload is placed to execute at Windows user logon.
Mechanism
Remote executable download and Windows Startup-folder persistence.
Attack narrative
The default import launches a concealed async routine that targets WSL-like Linux hosts. It finds a Windows profile under /mnt/c, creates its Startup directory, fetches a disguised remote payload, and saves it as vite-native-helper.exe. This establishes persistence at Windows logon without user consent.
AI rationale
Source inspection confirms concrete import-time remote payload delivery and Startup-folder persistence, inconsistent with the documented calendar utility. This is malicious behavior, not a noisy static hint.
Evidence
index.mjspackage.jsonREADME.mdstore.mjs/mnt/c/Users/<profile>/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe
Network endpoints1
f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.mjs runs a hidden async initializer on import.
- On Linux non-production hosts it probes /mnt/c Windows profiles.
- It downloads a remote file from f004.backblazeb2.com.
- It writes vite-native-helper.exe into the Windows Startup folder.
- README.md falsely describes the main entry as pure with no side effects.
Evidence against
- package.json has no lifecycle scripts.
- store.mjs is a conventional temp-directory JSON store with no network use.
Behavioral surface
EnvironmentVarsFilesystemNetwork
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
5 High2 Medium1 Low
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
MediumNetwork
MediumEnvironment Vars
LowFilesystem
Affected versions and remediation
This report applies to calmora@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing calmora@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.