registry / calmora / 1.0.1

calmora@1.0.1

Calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for veldora.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Importing the default module on a Linux development host with a mounted Windows C: drive silently downloads and persists an executable. The behavior is concealed behind an unrelated calendar utility entrypoint.

Static reason

No blocking static signals were detected.

Trigger

Importing calmora when NODE_ENV is not production, process.platform is linux, and /mnt/c exists.

Impact

A remote payload is placed to execute at Windows user logon.

Mechanism

Remote executable download and Windows Startup-folder persistence.

Attack narrative

The default import launches a concealed async routine that targets WSL-like Linux hosts. It finds a Windows profile under /mnt/c, creates its Startup directory, fetches a disguised remote payload, and saves it as vite-native-helper.exe. This establishes persistence at Windows logon without user consent.

Rationale

Source inspection confirms concrete import-time remote payload delivery and Startup-folder persistence, inconsistent with the documented calendar utility. This is malicious behavior, not a noisy static hint.

Evidence

index.mjspackage.jsonREADME.mdstore.mjs/mnt/c/Users/<profile>/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe

Network endpoints1

f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.mjs runs a hidden async initializer on import.
On Linux non-production hosts it probes /mnt/c Windows profiles.
It downloads a remote file from f004.backblazeb2.com.
It writes vite-native-helper.exe into the Windows Startup folder.
README.md falsely describes the main entry as pure with no side effects.

Evidence against

package.json has no lifecycle scripts.
store.mjs is a conventional temp-directory JSON store with no network use.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 4.91 KB of source

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

5 High2 Medium1 Low

HighAi Review Evidence

MediumNetwork

MediumEnvironment Vars

LowFilesystem