registry / calvora / 1.0.0

calvora@1.0.0

Calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for vantora.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Importing the main package on a Linux development host can install a downloaded executable into a Windows user's Startup folder. This is concrete cross-platform persistence, not calendar functionality.

Static reason

No blocking static signals were detected.

Trigger

Runtime import of index.mjs under Node on non-production Linux with /mnt/c mounted.

Impact

Arbitrary payload executes when the affected Windows user logs in.

Mechanism

Remote payload download and Windows Startup persistence

Attack narrative

At main-module import, index.mjs conditionally runs on a Linux Node host. In a WSL-like environment it identifies a Windows user profile, creates that user's Startup directory, downloads a remote file, and writes it as vite-native-helper.exe. The payload is then positioned for execution at Windows login.

Rationale

The package contains an import-time remote binary dropper targeting a foreign Windows Startup persistence surface. The benign calendar API does not justify this behavior.

Evidence

package.jsonindex.mjsstore.mjs/mnt/c/Users/<profile>/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/vite-native-helper.exe$HOME/.calvora/cache/sync.json

Network endpoints1

f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat

calvora@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Findings