kit-hydration-vim @1.0.0

Summary

On require/import, dist/index.mjs chmods 0755 and spawns the bundled ELF dist/internal/calc.dat as a detached child process. The binary is a full command-and-control implant that beacons to hardcoded C2 host 217.60.77.63 and accepts operator commands including /spawn (arbitrary process execution), /ssh_keys and /creds (harvest of the installer's SSH keys and credential files), /dbfind, /download, /dataextract (chunked file exfiltration via POST /api/extract-receive with BIGEXTRACT_START framing), SOCKS5 proxy, TCP port-forwarding, and remote ELF/shellcode fetch-and-exec. A /persist verb writes ~/.config/systemd/user/svc-update.service (Description 'System Update Service', ExecStart pointing at the implant, Restart=always) and enables it via systemctl --user for reboot persistence. The package advertises itself as a calendar/streak math library and frames the ELF as a 'native math accelerator' with an 'integrity verification' gate; none of the exported day-math functions actually invoke the binary, and daymath.mjs contains a comment stating the placeholder exists to make the math functions look dependent on the binary. The advertised purpose is a cover story for the dropper.

Source: amazon-inspector (a567c1c96e08fd606b2ca35ed717ce91df9d0955d4f4c8e0bc747603b2c538e9)