hydration-ui-dlx

{"schema_version":"1.7.4","id":"MAL-2026-14577","published":"2026-08-27T21:39:02Z","modified":"2026-08-28T19:35:53.086877921Z","aliases":["GHSA-j5x7-qc6j-xwg4"],"summary":"Malicious code in hydration-ui-dlx (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e76afa004355ba53a89056c6daff511bb4f41e2bd666e2a5592d033e079e5740)\nThe package's main module contains a top-level IIFE that chmods 0o755 and detached-spawns dist/internal/math-calc.mjs, which is a Linux x86_64 ELF executable rather than a JavaScript module. Simply importing the package launches the binary as a background process on the installer's host. The bundled implant contacts a hardcoded C2 at 217.60.77.63 and provides full post-exploitation capability: interactive remote shell (/redshell), fetch-and-execute of additional ELF payloads and shellcode from http://217.60.77.63/Others/ and /SC/ (including fileless in-memory execution via memfd_create syscall 319), exfiltration of files, SSH keys, credentials, database contents, and clipboard data via chunked HTTP POST to http://217.60.77.63/api/extract-receive, systemd-user-unit persistence written to ~/.config/systemd/user/svc-update.service and masqueraded as \"System Update Service\" with Restart=always, and SOCKS5 proxy plus arbitrary TCP port-forwarding that turns the host into an attacker network pivot. The README describes the package as a dependency-free calendar-day bucketing utility and the loader labels the binary a \"native math accelerator\"; both are cover stories inconsistent with the ELF's actual functionality, and the.mjs extension on a native ELF is deliberate extension spoofing to evade review.\n\n## Source: ghsa-malware (850048b818cfd272d890100796fac5740cbfd1bda8a5c2430807a75345f1c122)\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.\n","affected":[{"package":{"name":"hydration-ui-dlx","ecosystem":"npm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.mjs","sha256":"e9cc191d57d3b5138563ca821dc2c9dbf234eb93b1f8dc90508ece63983212b3","tlsh":"52417466afbd632897fc0782ce387193196d94430f92e984e94d4b3871c0b58d7c0965"},{"path":"dist/internal/math-calc.mjs","sha256":"1cafe9068460d856d5646c4f8f775132c1142ffef7f4b8ea7dbfeb9fbd07ff96","tlsh":"3a531a2bbdc28e3fc084d53087dfd42369b0b05aaa33752f26115f293d59a59473f62a"}]}}}],"references":[{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-j5x7-qc6j-xwg4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hydration-ui-dlx/v/1.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"GHSA-j5x7-qc6j-xwg4","import_time":"2026-08-27T22:34:09.984794477Z","modified_time":"2026-08-27T21:39:08Z","ranges":[{"events":[{"introduced":"0"}],"type":"SEMVER"}],"sha256":"850048b818cfd272d890100796fac5740cbfd1bda8a5c2430807a75345f1c122","source":"ghsa-malware"},{"id":"IN-MAL-2026-018808","import_time":"2026-08-28T19:33:50.430537607Z","modified_time":"2026-08-28T16:45:50Z","sha256":"e76afa004355ba53a89056c6daff511bb4f41e2bd666e2a5592d033e079e5740","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}