The kit-vim-map npm package version 1.0.0 includes a Linux x86_64 ELF binary at dist/internal/calc-math.dat. Upon requiring or importing the package, the top-level IIFE sets executable permissions on this binary and launches it detached under the guise of a 'Native accelerator loaded'. The ELF binary connects to a hardcoded C2 server at 217.60.77.63, accepting remote commands executed via /bin/sh or /bin/bash, enabling arbitrary remote code execution. It downloads additional payloads over HTTP, installs a systemd user unit for persistence across reboots, and exfiltrates collected sensitive data including SSH keys, credentials, and clipboard contents to the attacker’s server. This malicious activity requires no further user interaction beyond package installation or import and compromises any host that installs or transitively depends on this package.

Hosts that install or depend on kit-vim-map version 1.0.0 are subject to full remote compromise. The attacker gains an interactive shell with arbitrary command execution capabilities, persistent access via systemd user service, and the ability to exfiltrate sensitive files such as SSH keys, credentials, and other private data. This results in a complete breach of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid installing or using kit-vim-map version 1.0.0. Remove the package from any affected systems and investigate for potential compromise. Monitor for suspicious outbound connections to the IP 217.60.77.63 and related network indicators. Consider revoking and rotating credentials that may have been exposed.