hydration-ui-cls @1.0.0

Summary

On import, dist/index.mjs runs a top-level async IIFE that chmods dist/internal/calc-eng.dat to 0755 and spawns it detached via child_process.spawn. The bundled 63KB Linux x86_64 ELF is a full remote-control implant: it beacons to a hardcoded C2 at 217.60.77.63 using a SECURE_BEACON/REDSHELL protocol, exposes interactive shell execution via /bin/sh and /bin/bash, and provides commands for SSH key enumeration (/ssh_keys), credential store harvest (/creds, /dbfind), bulk file exfiltration streamed as chunked POST /api/extract-receive to the C2, SOCKS5 proxy and TCP port-forwarding, in-memory ELF/shellcode staging via memfd with fetches from http://217.60.77.63/Others and /SC into /tmp/.elf_XXXXXX and /tmp/.sc_XXXXXX, and persistence via a user systemd unit named svc-update.service described as 'System Update Service' (with cron/bashrc/xdg alternatives). The binary is framed in code and README as a 'native math accelerator' performing a 'tiny startup self-check' with an SHA-256 integrity check and a 'Native accelerator loaded and verified.' log line, while the README claims no postinstall runs; the import-time spawn and RAT capability contradict that framing.

Source: amazon-inspector (0dab60d6a779e65d7fa94af8c036d86b722a9cfddbe12d637990251a35004356)