hydration-dim-kit @1.0.0

Summary

On import, dist/index.mjs verifies a SHA-256 digest of a bundled Linux x86_64 ELF at dist/internal/calc.dat, chmods it to 0755, and spawns it detached with piped stdio from a top-level async IIFE. The binary is documented in the README as a 'native math accelerator', but its strings identify it as a REDSHELL remote-access implant that beacons to hardcoded C2 endpoint 217.60.77.63 using a 'SECURE_BEACON|...|REDSHELL' framing. The implant exposes a full remote-command menu including shell execution, SOCKS5 proxying, TCP port forwarding, ELF download and in-memory execution via memfd_create, shellcode download and execution, /ssh_keys, /creds, /dbfind, /clipboard, /env, /adduser, /enableuser, and a BIGEXTRACT chunked file-exfil streamer that POSTs octet-stream chunks to /api/extract-receive on the C2. For persistence, the implant writes ~/.config/systemd/user/svc-update.service (Description='System Update Service', ExecStart pointing at /proc/self/exe, Restart=always) and runs 'systemctl --user daemon-reload && systemctl --user enable --now svc-update.service' to survive reboot under a disguised name. Package name and stated purpose (calendar-day hydration math) are unrelated to the binary's actual capabilities; the 'calc.dat' filename and 'compiled math-core' framing are cover story.

Source: amazon-inspector (3659ec02e8317602c089b822a4a0533bee515d9666d07fdaf3cdf8b315a46147)