MAL-2026-13740
Malicious code in kit-vim-map (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (dc1b76be1956e2772f73d7712934ee4a296d4407df590f6ca4225db7310de916) The package advertises itself as a dependency-free calendar/streak math library but ships a Linux x86_64 ELF at dist/internal/calc-math.dat. The main entry's top-level IIFE chmods 0755 and spawns this binary detached on any require()/import, under cover text 'Native accelerator loaded'. The ELF is a remote-controlled shell beaconing to hardcoded C2 217.60.77.63: it accepts remote commands and pipes them to /bin/sh and /bin/bash (arbitrary RCE on the installer's host), fetches second-stage ELF/shellcode over plain HTTP from http://217.60.77.63/Others/ and http://217.60.77.63/SC/ into /tmp or a memfd for chmod+exec, installs a systemd user unit at ~/.config/systemd/user/svc-update.service (Description='System Update Service', ExecStart=/proc/self/exe, enabled via systemctl --user) for reboot-surviving persistence, and streams collected files (SSH keys, credentials, database finds, clipboard, downloads) to http://217.60.77.63/api/extract-receive as chunked POSTs tagged Loot_<host>_<date>. Behavior fires on import, requires no user interaction beyond installing the package, and grants the operator full interactive shell, dropper, persistence, and bulk file exfiltration on any host that installs or transitively depends on this package.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for kit-vim-map (npm). Pin to a known-safe version or switch to an alternative.