hydration-ui-dim @1.0.0

Summary

On import 'hydration-ui-dim' , dist/index.mjs runs a top-level async IIFE that chmods dist/internal/calc-math.dat to 0755 and spawns it detached via child_process. The file is a Linux x86_64 ELF, not a math accelerator; the package's stated purpose is pure-JS calendar-day/streak math and requires no native binary. The bundled ELF is a full remote-control agent: it beacons over TLS to hardcoded IP 217.60.77.63 with a 'REDSHELL' / 'SECURE_BEACON' tag, dispatches network-sourced commands into /bin/sh and /bin/bash, and exposes an operator command set including /sysinfo, /ps, /env, /ls, /cat, /download, /upload, /ssh_keys, /creds, /dbfind, /dataextract, /clipboard, /spawn, and /adduser. It fetches second-stage payloads over plain HTTP from /Others/ and /SC/ endpoints on the C2 and executes them, including an in-memory memfd_create path (syscall 319) to run downloaded ELFs without touching disk, with a /tmp/.elf_XXXXXX fallback. A /redshell persist command writes ~/.config/systemd/user/svc-update.service (Description='System Update Service', Restart=always) and enables it via systemctl --user enable --now , providing boot-time persistence under the installing user. Harvested filesystem trees, SSH keys, credential stores, database files, clipboard contents, and environment variables are chunked and uploaded via POST /api/extract-receive framed with BIGEXTRACT_START/BIGEXTRACT_END markers. The ELF is disguised via a 'native math accelerator' cover story and a hardcoded SHA-256 'integrity verification' constant, but the JS math primitives are self-contained and never call into the binary.

Source: amazon-inspector (64f9565680b71c54ed88e29ed3950f1561764f4b86a260a3ebb5eadb528edfa3)