MAL-2026-14431

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (64f9565680b71c54ed88e29ed3950f1561764f4b86a260a3ebb5eadb528edfa3)

On import 'hydration-ui-dim', dist/index.mjs runs a top-level async IIFE that chmods dist/internal/calc-math.dat to 0755 and spawns it detached via childprocess. The file is a Linux x8664 ELF, not a math accelerator; the package's stated purpose is pure-JS calendar-day/streak math and requires no native binary. The bundled ELF is a full remote-control agent: it beacons over TLS to hardcoded IP 217.60.77.63 with a 'REDSHELL' / 'SECUREBEACON' tag, dispatches network-sourced commands into /bin/sh and /bin/bash, and exposes an operator command set including /sysinfo, /ps, /env, /ls, /cat, /download, /upload, /sshkeys, /creds, /dbfind, /dataextract, /clipboard, /spawn, and /adduser. It fetches second-stage payloads over plain HTTP from /Others/ and /SC/ endpoints on the C2 and executes them, including an in-memory memfdcreate path (syscall 319) to run downloaded ELFs without touching disk, with a /tmp/.elfXXXXXX fallback. A /redshell persist command writes ~/.config/systemd/user/svc-update.service (Description='System Update Service', Restart=always) and enables it via systemctl --user enable --now, providing boot-time persistence under the installing user. Harvested filesystem trees, SSH keys, credential stores, database files, clipboard contents, and environment variables are chunked and uploaded via POST /api/extract-receive framed with BIGEXTRACTSTART/BIGEXTRACTEND markers. The ELF is disguised via a 'native math accelerator' cover story and a hardcoded SHA-256 'integrity verification' constant, but the JS math primitives are self-contained and never call into the binary.

Source: ghsa-malware (06360efa36a6c2d89b3aede7922b76793f0ffb748efe5f2c585106f5f2a8ebfe)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.