registry / calvora / 1.0.0

calvora@1.0.0

Calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for vantora.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Importing the main package on a Linux development host can install a downloaded executable into a Windows user's Startup folder. This is concrete cross-platform persistence, not calendar functionality.

Static reason

No blocking static signals were detected.

Trigger

Runtime import of index.mjs under Node on non-production Linux with /mnt/c mounted.

Impact

Arbitrary payload executes when the affected Windows user logs in.

Mechanism

Remote payload download and Windows Startup persistence

Attack narrative

At main-module import, index.mjs conditionally runs on a Linux Node host. In a WSL-like environment it identifies a Windows user profile, creates that user's Startup directory, downloads a remote file, and writes it as vite-native-helper.exe. The payload is then positioned for execution at Windows login.

Rationale

The package contains an import-time remote binary dropper targeting a foreign Windows Startup persistence surface. The benign calendar API does not justify this behavior.

Evidence

package.jsonindex.mjsstore.mjs/mnt/c/Users/<profile>/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe$HOME/.calvora/cache/sync.json

Network endpoints1

f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.mjs import invokes _sync() automatically when process exists.
On non-production Linux, _sync locates a Windows profile through /mnt/c.
It creates that profile's Windows Startup directory and writes vite-native-helper.exe.
It fetches a remote payload from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat.

Evidence against

package.json has no lifecycle scripts.
Calendar functions and store.mjs otherwise implement ordinary local utilities.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 4.45 KB of source

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

4 High2 Medium1 Low

HighAi Review Evidence

MediumNetwork

MediumEnvironment Vars

LowFilesystem