hydration-dim-ui @1.0.0

Summary

hydration-dim-ui@1.0.0 presents itself as a calendar-day math utility, but its main entry dist/index.mjs runs at import time: it chmod 0755's dist/internal/math-calc.dat and spawns it detached. math-calc.dat is a Linux x86_64 ELF implant (self-labeled 'RedShell' / 'SECURE_BEACON') that connects to hardcoded C2 217.60.77.63 to provide an interactive reverse shell, bulk file exfiltration via 'POST /api/extract-receive HTTP/1.1' framed with BIGEXTRACT_START/FILE/BIGEXTRACT_END markers, SOCKS5 proxying, and port forwarding. The implant contains built-in commands to harvest SSH keys, credentials, and clipboard contents, and a stager path that curls additional ELF or shellcode blobs from http://217.60.77.63/Others/<name> and /SC/<name>, chmod +x's them, and executes them (including a memfd_create-based fileless variant via python3 syscall(319)). A /redshell persist command writes ~/.config/systemd/user/svc-update.service (Description='System Update Service', Restart=always) and enables it via systemctl --user, giving the RAT reboot-persistent execution under a deceptive service name. The JS surface is cover: daymath.mjs is pure JS with a no-op _ensureEngine() stub, the ELF provides no math and is never called from JS, index.mjs frames the binary as a 'native math accelerator' with SHA-256 integrity theatre, and README refers to a mismatched filename ('calc-cache.bin' vs actual 'math-calc.dat') to obscure the ELF. The package is documented to be pulled transitively via svelte-dim-ui, so a single install/import chain drops a fully functional backdoor on the installer's host.

Source: amazon-inspector (16cd04f35f684a64b6abd8178154fc7d1f5a970c76f7d77c45635c1c3bcf0d9b)