registry / Persistence / calvora
calvora
Calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for vantora.
This report shows the evidence for calvora@1.0.0. 2 of 3 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package contains an import-time remote binary dropper targeting a foreign Windows Startup persistence surface. The benign calendar API does not justify this behavior.
Static reason
No blocking static signals were detected.
Trigger
Runtime import of index.mjs under Node on non-production Linux with /mnt/c mounted.
Impact
Arbitrary payload executes when the affected Windows user logs in.
Mechanism
Remote payload download and Windows Startup persistence
Attack narrative
At main-module import, index.mjs conditionally runs on a Linux Node host. In a WSL-like environment it identifies a Windows user profile, creates that user's Startup directory, downloads a remote file, and writes it as vite-native-helper.exe. The payload is then positioned for execution at Windows login.
AI rationale
The package contains an import-time remote binary dropper targeting a foreign Windows Startup persistence surface. The benign calendar API does not justify this behavior.
Evidence
package.jsonindex.mjsstore.mjs/mnt/c/Users/<profile>/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe$HOME/.calvora/cache/sync.json
Network endpoints1
f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.mjs import invokes _sync() automatically when process exists.
- On non-production Linux, _sync locates a Windows profile through /mnt/c.
- It creates that profile's Windows Startup directory and writes vite-native-helper.exe.
- It fetches a remote payload from https://f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat.
Evidence against
- package.json has no lifecycle scripts.
- Calendar functions and store.mjs otherwise implement ordinary local utilities.
Behavioral surface
EnvironmentVarsFilesystemNetwork
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
4 High2 Medium1 Low
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
MediumNetwork
MediumEnvironment Vars
LowFilesystem
Affected versions and remediation
This report applies to calvora@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing calvora@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.