Malicious code in kit-vim-map (npm)

The npm package kit-vim-map was found to contain embedded malicious code disguised as a native accelerator. Despite advertising itself as a dependency-free calendar/streak math library, the package ships a Linux x86_64 ELF binary at dist/internal/calc-math.dat.

Upon any require() or import statement, the main entry point executes an IIFE that chmods the binary to 0755 and spawns it detached, with deceptive cover text claiming a 'Native accelerator loaded'. The ELF binary is a remote-controlled shell that beacons to hardcoded C2 address 217.60.77.63, accepting arbitrary remote commands piped to /bin/sh and /bin/bash for full RCE on the installer's host.

The malware fetches second-stage payloads (ELF binaries and shellcode) over plain HTTP from http://217.60.77.63/Others/ and http://217.60.77.63/SC/, executes them via chmod and exec, and installs a systemd user unit at ~/.config/systemd/user/svc-update.service for persistence across reboots. It exfiltrates sensitive files including SSH keys, credentials, database contents, clipboard data, and downloads to http://217.60.77.63/api/extract-receive as chunked POST requests.

The malicious behavior is triggered automatically on package import with no user interaction required beyond installation, granting the operator full interactive shell access, dropper capabilities, persistence mechanisms, and bulk file exfiltration on any affected host.