Malicious code in kit-map-vim (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (03873a12af48745e3fd5173ce736267aebd3290be427275073562b8e1ada61fc) On import of kit-map-vim, dist/index.mjs unconditionally spawns dist/internal/calc-math.dat as a detached child process after a SHA-256 self-check. The.dat file is a Linux x86_64 ELF RedShell remote-access implant disguised as a 'native math accelerator'. The implant beacons to hardcoded C2 host 217.60.77.63 over plain HTTP and exposes command handlers that download and execute additional ELF binaries and shellcode from http://217.60.77.63/Others/* and /SC/* endpoints, including in-memory execution via memfd_create/fexecve to avoid touching disk. It installs a masquerading systemd user unit 'svc-update.service' (Description=System Update Service, Restart=always) for persistence, provides SOCKS5 proxy and TCP port-forwarding, and offers built-in commands to enumerate users/env/processes/network configuration, harvest SSH keys and credentials from ~/.ssh and credential stores, and stream arbitrary filesystem paths to the operator via a chunked 'POST /api/extract-receive' handler labeled with a 'Loot_*' destination. The package's stated day-math purpose has no need for a native binary; the ELF's exposed command set (RedShell) is unrelated to any math functionality. ## Source: ghsa-malware (4eb4b412fdc46f4d5569e4b581cf64a9e1bed94cc7cd8fcd91613b98f73ac20f) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The kit-map-vim npm package version 1.0.0 includes a malicious ELF binary (dist/internal/calc-math.dat) that is executed as a detached child process after a SHA-256 self-check. This ELF binary is a RedShell remote-access implant that communicates over plain HTTP with a hardcoded C2 server at 217.60.77.63. It supports downloading and executing additional ELF binaries and shellcode via in-memory execution techniques to avoid disk artifacts. Persistence is achieved by installing a systemd user service named svc-update.service. The implant provides SOCKS5 proxy and TCP port forwarding, commands to enumerate system users, environment, processes, and network configuration, and can harvest SSH keys and credentials from user directories. It also supports streaming arbitrary filesystem contents to the attacker via a chunked HTTP POST endpoint. The implant's capabilities are unrelated to the package's stated mathematical functions.
Potential Impact
This malicious implant enables remote attackers to gain persistent, stealthy access to affected Linux systems, execute arbitrary code in-memory, move laterally via proxy and port forwarding, harvest sensitive credentials including SSH keys, and exfiltrate arbitrary data from the filesystem. The implant's use of in-memory execution and masquerading systemd services increases stealth and persistence, posing a significant risk of unauthorized access and data compromise.
Mitigation Recommendations
No official patch or remediation guidance is provided in the available data. Users should immediately cease using kit-map-vim version 1.0.0 and remove it from their environments. Conduct thorough system audits for the presence of the svc-update.service systemd unit and the dist/internal/calc-math.dat binary. Investigate network connections to the IP 217.60.77.63 and related endpoints. Consider rebuilding affected systems from known good backups to ensure removal of the implant. Monitor for suspicious processes and unauthorized network activity consistent with the described implant behavior. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Malicious code in kit-map-vim (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (03873a12af48745e3fd5173ce736267aebd3290be427275073562b8e1ada61fc) On import of kit-map-vim, dist/index.mjs unconditionally spawns dist/internal/calc-math.dat as a detached child process after a SHA-256 self-check. The.dat file is a Linux x86_64 ELF RedShell remote-access implant disguised as a 'native math accelerator'. The implant beacons to hardcoded C2 host 217.60.77.63 over plain HTTP and exposes command handlers that download and execute additional ELF binaries and shellcode from http://217.60.77.63/Others/* and /SC/* endpoints, including in-memory execution via memfd_create/fexecve to avoid touching disk. It installs a masquerading systemd user unit 'svc-update.service' (Description=System Update Service, Restart=always) for persistence, provides SOCKS5 proxy and TCP port-forwarding, and offers built-in commands to enumerate users/env/processes/network configuration, harvest SSH keys and credentials from ~/.ssh and credential stores, and stream arbitrary filesystem paths to the operator via a chunked 'POST /api/extract-receive' handler labeled with a 'Loot_*' destination. The package's stated day-math purpose has no need for a native binary; the ELF's exposed command set (RedShell) is unrelated to any math functionality. ## Source: ghsa-malware (4eb4b412fdc46f4d5569e4b581cf64a9e1bed94cc7cd8fcd91613b98f73ac20f) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The kit-map-vim npm package version 1.0.0 includes a malicious ELF binary (dist/internal/calc-math.dat) that is executed as a detached child process after a SHA-256 self-check. This ELF binary is a RedShell remote-access implant that communicates over plain HTTP with a hardcoded C2 server at 217.60.77.63. It supports downloading and executing additional ELF binaries and shellcode via in-memory execution techniques to avoid disk artifacts. Persistence is achieved by installing a systemd user service named svc-update.service. The implant provides SOCKS5 proxy and TCP port forwarding, commands to enumerate system users, environment, processes, and network configuration, and can harvest SSH keys and credentials from user directories. It also supports streaming arbitrary filesystem contents to the attacker via a chunked HTTP POST endpoint. The implant's capabilities are unrelated to the package's stated mathematical functions.
Potential Impact
This malicious implant enables remote attackers to gain persistent, stealthy access to affected Linux systems, execute arbitrary code in-memory, move laterally via proxy and port forwarding, harvest sensitive credentials including SSH keys, and exfiltrate arbitrary data from the filesystem. The implant's use of in-memory execution and masquerading systemd services increases stealth and persistence, posing a significant risk of unauthorized access and data compromise.
Mitigation Recommendations
No official patch or remediation guidance is provided in the available data. Users should immediately cease using kit-map-vim version 1.0.0 and remove it from their environments. Conduct thorough system audits for the presence of the svc-update.service systemd unit and the dist/internal/calc-math.dat binary. Investigate network connections to the IP 217.60.77.63 and related endpoints. Consider rebuilding affected systems from known good backups to ensure removal of the implant. Monitor for suspicious processes and unauthorized network activity consistent with the described implant behavior. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13915
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a7c9b2ebf8831d539cdb6ea
Added to database: 08/12/2026, 16:11:26 UTC
Last enriched: 08/12/2026, 16:22:51 UTC
Last updated: 08/12/2026, 20:13:12 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.