kit-map-vim
Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store.
This report shows the evidence for kit-map-vim@1.0.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete import-time malware execution chain, not a legitimate math accelerator. Absence of an npm lifecycle hook does not mitigate execution when the package is imported.
Static reason
No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Any runtime import of kit-map-vim.
Impact
Credential theft, remote code execution, data exfiltration, and persistence.
Mechanism
Import-time detached execution of a malicious bundled binary.
Attack narrative
The root module's import-time async initializer marks calc-math.dat executable and detached-spawns it. Static inspection of that ELF found commands to download and execute remote payloads, collect SSH and browser credential material, upload archives, and install cron, shell-profile, systemd, or XDG persistence. The integrity hash only validates this shipped malicious artifact.
AI rationale
This is a concrete import-time malware execution chain, not a legitimate math accelerator. Absence of an npm lifecycle hook does not mitigate execution when the package is imported.
Evidence
package.jsondist/index.mjsdist/internal/calc-math.dat/tmp/.elf_XXXXXX~/.ssh~/.config/systemd/user/svc-update.service~/.bashrc
Network endpoints2
api.ipify.orglitterbox.catbox.moe/resources/internals/api.php
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Root import immediately launches bundled ELF.
- Import code chmods and detached-spawns the ELF.
- ELF strings show payload download/execution, credential harvesting, exfiltration, and persistence.
Evidence against
- package.json has no lifecycle scripts.
- No network logic appears in the JavaScript wrapper itself.
Behavioral surface
ChildProcessCryptoFilesystemShell
Source & flagged code
3 flagged · loading sourcedist/internal/calc-math.datView file
•path = dist/internal/calc-math.dat
kind = native_binary
sizeBytes = 63616
magicHex = [redacted]
Medium
dist/index.mjsView file
•matchType = malicious_source_fingerprint_signature
signature = 5501fa102f254897
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = kit-vim-map@1.0.0
matchedPath = dist/index.mjs
matchedIdentity = npm:a2l0LXZpbS1tYXA:1.0.0
similarity = 1.000
shingleOverlap = 2
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/index.mjsView on unpkg34try {
fs.chmodSync(binaryPath, 0o755);
High
Ai Review Evidence
Findings
2 High1 Medium1 Low
HighKnown Malware Source Fingerprint Signaturedist/index.mjs
HighAi Review Evidencedist/index.mjs
MediumShips Native Binarydist/internal/calc-math.dat
LowFilesystem
Affected versions and remediation
This report applies to kit-map-vim@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing kit-map-vim@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.