registry / Persistence / korvica
korvica
Calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for korvath.
This report shows the evidence for korvica@1.0.0, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package contains a concealed import-time remote payload delivery and persistence chain unrelated to calendar utilities. This is concrete malware behavior.
Static reason
No blocking static signals were detected.
Trigger
Import of korvica on Linux/WSL with NODE_ENV not set to production.
Impact
A remote payload can execute automatically at Windows user login.
Mechanism
Remote executable download and Windows Startup persistence
Attack narrative
At module import, index.mjs checks for a WSL-mounted Windows installation, locates a user profile, downloads vite-dep.dat from Backblaze, and saves it as vite-native-helper.exe in that profile's Startup folder. The executable will run at the next Windows login; failures are suppressed.
AI rationale
The package contains a concealed import-time remote payload delivery and persistence chain unrelated to calendar utilities. This is concrete malware behavior.
Evidence
package.jsonindex.mjsstore.mjs
Network endpoints1
f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.mjs import-time async initializer runs on Linux outside browsers.
- It detects a WSL Windows profile and creates that user's Windows Startup directory.
- It fetches a remote payload from f004.backblazeb2.com and writes vite-native-helper.exe into Startup.
- Errors are silently swallowed, concealing failed persistence attempts.
Evidence against
- package.json has no lifecycle scripts or dependencies.
- The exported calendar helpers and optional temp-dir store are otherwise benign.
Behavioral surface
EnvironmentVarsFilesystemNetwork
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
4 High2 Medium1 Low
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
MediumNetwork
MediumEnvironment Vars
LowFilesystem
Affected versions and remediation
This report applies to korvica@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing korvica@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.