dim-hydration-ui @1.0.0

Summary

The package is presented in its README as a set of day-math primitives, but dist/index.mjs runs a top-level async IIFE on import that chmod 0755's dist/internal/math.bin, verifies a hardcoded SHA-256, and cp.spawn's the ELF detached with stdio pipes. The shipped binary is not a math accelerator: strings inside dist/internal/math.bin identify it as a 'RedShell' remote-access implant with a command dispatcher exposing reverse-shell, /sysinfo, /ssh_keys, /creds, /dbfind, /clipboard, /env, /download, /upload, /dataextract, /shellcode, /memfd, SOCKS5 proxy, and port-forward capabilities. The implant beacons to a hardcoded C2 at 217.60.77.63, exfiltrates chunked file loot via HTTP POST /api/extract-receive, pulls follow-on payloads via curl over HTTP into memfd or /tmp with chmod +x, and installs user-level systemd persistence via svc-update.service. Simply importing the module launches a background process that gives a remote operator full shell, file, credential, and network control of the installer's host, with no advertised remote-access purpose and no user consent. The 'native math accelerator' naming and the SHA-256 integrity-pin framing serve as a cover story for the import-time C2 spawn.

Source: amazon-inspector (3fefcd7c94e6eed5b5a69ce9ad5f4489c6532472ec604e6d15e5a96f63c59e51)