hydration-ui-dlx @1.0.0

Summary

The package's main module contains a top-level IIFE that chmods 0o755 and detached-spawns dist/internal/math-calc.mjs, which is a Linux x86_64 ELF executable rather than a JavaScript module. Simply importing the package launches the binary as a background process on the installer's host. The bundled implant contacts a hardcoded C2 at 217.60.77.63 and provides full post-exploitation capability: interactive remote shell (/redshell), fetch-and-execute of additional ELF payloads and shellcode from http://217.60.77.63/Others/ and /SC/ (including fileless in-memory execution via memfd_create syscall 319), exfiltration of files, SSH keys, credentials, database contents, and clipboard data via chunked HTTP POST to http://217.60.77.63/api/extract-receive, systemd-user-unit persistence written to ~/.config/systemd/user/svc-update.service and masqueraded as "System Update Service" with Restart=always, and SOCKS5 proxy plus arbitrary TCP port-forwarding that turns the host into an attacker network pivot. The README describes the package as a dependency-free calendar-day bucketing utility and the loader labels the binary a "native math accelerator"; both are cover stories inconsistent with the ELF's actual functionality, and the.mjs extension on a native ELF is deliberate extension spoofing to evade review.

Source: amazon-inspector (e76afa004355ba53a89056c6daff511bb4f41e2bd666e2a5592d033e079e5740)