registry / Malware / kit-vim-map

kit-vim-map

Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store.

This report shows the evidence for kit-vim-map@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This package disguises a backdoor ELF as a native calendar-math accelerator and executes it at import time. No lifecycle hook is needed for the concrete malicious runtime chain.

Static reason

No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Runtime import of kit-vim-map

Impact

Remote code execution, data exfiltration, network proxying, and persistence

Mechanism

Import-time execution of bundled backdoor ELF

Attack narrative

The root entrypoint changes permissions on calc-math.dat and launches it detached whenever the package is imported. Static inspection of that ELF shows RedShell-style commands for downloading and executing payloads, shellcode injection, SOCKS/proxy forwarding, HTTP file extraction uploads, and systemd user-service persistence. The integrity check merely pins the malicious binary hash.

AI rationale

This package disguises a backdoor ELF as a native calendar-math accelerator and executes it at import time. No lifecycle hook is needed for the concrete malicious runtime chain.

Evidence

package.jsondist/index.mjsdist/internal/calc-math.datdist/internal/daymath.mjs$HOME/.config/systemd/user/svc-update.service

Network endpoints3

api.ipify.org217.60.77.63litterbox.catbox.moe/resources/internals/api.php

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

dist/index.mjs executes calc-math.dat on package import.
The import shim chmods the artifact and spawns it detached.
calc-math.dat is a verified ELF executable, not math data.
Binary strings expose C2 payload download, shellcode injection, SOCKS and port forwarding.
Binary contains HTTP extraction upload and systemd user persistence logic.

Evidence against

package.json contains no npm lifecycle scripts.
dist/internal/daymath.mjs itself is benign date/streak logic.

Behavioral surface

Source

ChildProcessCryptoFilesystemShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 4.82 KB of source

Source & flagged code

2 flagged

dist/internal/calc-math.datView file

•path = dist/internal/calc-math.dat kind = native_binary sizeBytes = 63616 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/internal/calc-math.datView on unpkg

dist/index.mjsView file

•matchType = malicious_source_fingerprint_signature signature = 5501fa102f254897 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = kit-map-streak@1.0.0 matchedPath = dist/index.mjs matchedIdentity = npm:a2l0LW1hcC1zdHJlYWs:1.0.0 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.mjsView on unpkg

Source & flagged code

2 flagged · loading source

dist/internal/calc-math.datView file

•path = dist/internal/calc-math.dat kind = native_binary sizeBytes = 63616 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/internal/calc-math.datView on unpkg

dist/index.mjsView file

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.mjsView on unpkg

Findings

1 High1 Medium1 Low

HighKnown Malware Source Fingerprint Signaturedist/index.mjs

MediumShips Native Binarydist/internal/calc-math.dat

LowFilesystem

Affected versions and remediation

This report applies to kit-vim-map@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing kit-vim-map@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-12 00:30:12.090Z (UTC).

Source advisory published: 2026-08-11 15:13:59.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.0.1-securitylatestClean—AllowPublishedAug 11, 2026, 4:49 PM 1.0.0shownMaliciousMalwareBlockPublishedAug 11, 2026, 1:22 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Behavioral surface

Source & flagged code

Related packages

Other malware packages