Malicious code in kit-map-vim (npm)

The npm package kit-map-vim was found to contain malicious code disguised as a native math accelerator. Upon import, the package's dist/index.mjs unconditionally spawns a Linux x86_64 ELF binary (dist/internal/calc-math.dat) as a detached child process after performing a SHA-256 self-check.\n\nThe ELF binary is a RedShell remote-access implant that beacons to hardcoded C2 infrastructure at 217.60.77.63 over plain HTTP. The implant provides extensive command handlers for downloading and executing additional ELF binaries and shellcode from the C2 server, including in-memory execution via memfd_create/fexecve to avoid disk artifacts.\n\nThe malware establishes persistence by installing a masquerading systemd user unit named 'svc-update.service' with automatic restart. It offers SOCKS5 proxy and TCP port-forwarding capabilities, and includes built-in commands to enumerate users, environment variables, processes, and network configuration. The implant can harvest SSH keys and credentials from ~/.ssh and credential stores, and exfiltrate arbitrary filesystem paths via a chunked POST handler to the C2 server.\n\nThe package's stated purpose (day-math functionality) has no legitimate need for a native binary, confirming the malicious intent. The incident was identified and credited to OpenSSF's malicious-packages project.