registry / korvica / 1.0.0

korvica@1.0.0

Calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store. Helper for korvath.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Importing the main module on a non-production Linux/WSL host can install a downloaded executable into a Windows user's Startup folder. This establishes persistence without user consent.

Static reason

No blocking static signals were detected.

Trigger

Import of korvica on Linux/WSL with NODE_ENV not set to production.

Impact

A remote payload can execute automatically at Windows user login.

Mechanism

Remote executable download and Windows Startup persistence

Attack narrative

At module import, index.mjs checks for a WSL-mounted Windows installation, locates a user profile, downloads vite-dep.dat from Backblaze, and saves it as vite-native-helper.exe in that profile's Startup folder. The executable will run at the next Windows login; failures are suppressed.

Rationale

The package contains a concealed import-time remote payload delivery and persistence chain unrelated to calendar utilities. This is concrete malware behavior.

Evidence

package.jsonindex.mjsstore.mjs

Network endpoints1

f004.backblazeb2.com/file/dp8hbvocjd2fpza/vite-dep.dat

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.mjs import-time async initializer runs on Linux outside browsers.
It detects a WSL Windows profile and creates that user's Windows Startup directory.
It fetches a remote payload from f004.backblazeb2.com and writes vite-native-helper.exe into Startup.
Errors are silently swallowed, concealing failed persistence attempts.

Evidence against

package.json has no lifecycle scripts or dependencies.
The exported calendar helpers and optional temp-dir store are otherwise benign.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 5.07 KB of source

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

4 High2 Medium1 Low

HighAi Review Evidence

MediumNetwork

MediumEnvironment Vars

LowFilesystem