The kit-hydration-vim npm package version 1.0.0 includes a malicious payload embedded in dist/internal/calc.dat, an ELF binary executed as a detached child process upon import. This implant connects to a hardcoded C2 server at 217.60.77.63 and supports commands for spawning processes, harvesting SSH keys and credentials, searching databases, downloading files, exfiltrating data in chunks, SOCKS5 proxying, TCP port forwarding, and fetching/executing additional ELF binaries or shellcode. It achieves persistence by creating and enabling a systemd user service named svc-update.service. The package falsely advertises itself as a calendar and math utility, with the binary framed as a 'native math accelerator' that is never actually invoked by the exported functions, serving only as a cover for the malicious implant.

Systems with this package installed are fully compromised, as the implant grants remote attackers extensive control over the host, including execution of arbitrary commands, credential theft, data exfiltration, and persistence. All secrets and keys on affected systems are at risk and should be considered compromised. Removing the package alone may not eliminate the threat due to potential additional malware installed by the attacker.

Immediate removal of the kit-hydration-vim package version 1.0.0 is required. All credentials and keys stored on the affected system should be rotated from a separate, trusted machine. Due to the high level of compromise, a full system rebuild or forensic analysis is recommended to ensure complete eradication of the implant and any secondary malware. No official patch or fix is available for this malicious package; mitigation relies on removal and credential rotation.