kit-map-vim@1.0.0

Analysis

kit-map-vim@1.0.0 ships a bundled ELF binary (dist/internal/calc-math.dat) that is a full remote-access trojan. Importing the package spawns the binary detached at load time. The implant provides a remote shell with in-memory (memfd) payload execution and shellcode download/execution, a reverse tunnel (RC2TUN), SOCKS/port-forwarding, and persistence via cron, .bashrc, and a systemd user service. It harvests SSH keys (~/.ssh id_*, authorized_keys, known_hosts, config, ssh-agent keys), browser credentials (Chrome/Chromium/Brave/Edge Login Data, Cookies, Local State; Firefox logins.json and key4.db), and database credentials (.pgpass, .my.cnf, DB configs and env vars). It can download and execute arbitrary URLs, load arbitrary shared libraries, create/enable system users, and exfiltrate files to litterbox.catbox.moe. C2 endpoint IP: 217[.]60[.]77[.]63; public-IP discovery via api[.]ipify[.]org.