Malicious code in hydration-cls-ui (npm)

The hydration-cls-ui package (version 1.0.0) includes a malicious x86_64 Linux ELF binary at dist/internal/calc.dat that is automatically launched when the package is imported. The binary, identified as the RedShell remote-access tool, provides capabilities such as SOCKS5 proxying, TCP port forwarding, arbitrary shell command execution with output capture, and TLS beaconing to a hardcoded C2 server at 217.60.77.63. It also supports second-stage payload delivery via HTTP downloads and executes them in memory or from temporary files. The malware harvests SSH keys, credentials, environment variables, clipboard contents, and other sensitive data, exfiltrating it in chunks to the C2. Persistence is achieved through systemd user services, cron jobs, bashrc modifications, and XDG autostart entries. The package attempts to disguise the malicious binary as a native math accelerator and integrity verification component.

Systems that import the hydration-cls-ui package version 1.0.0 on Linux x86_64 are at risk of remote compromise. The malicious ELF binary provides attackers with full remote access, data exfiltration capabilities, and persistence mechanisms, potentially leading to credential theft, environment compromise, and long-term unauthorized access. This can severely impact confidentiality, integrity, and availability of affected systems.

No official patch or remediation is currently documented. Users should immediately cease use of hydration-cls-ui version 1.0.0 and remove it from their environments. Conduct thorough system audits for the presence of the calc.dat binary and associated persistence mechanisms such as systemd user services named svc-update.service, cron jobs, and autostart entries. Block network communications to the hardcoded C2 IP 217.60.77.63 and related domains. Monitor for suspicious processes spawned by this package. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.