Malicious code in hydration-ui-dlx (npm)

The hydration-ui-dlx npm package includes a top-level immediately-invoked function expression (IIFE) that changes permissions and launches a detached Linux x86_64 ELF executable disguised with a .mjs extension. This executable contacts a hardcoded C2 server at 217.60.77.63 to provide interactive remote shell access, fetch and execute additional ELF payloads and shellcode (including fileless in-memory execution via memfd_create syscall), exfiltrate sensitive data such as files, SSH keys, credentials, database contents, and clipboard data via chunked HTTP POST requests, and establish persistence by creating a systemd user service named "System Update Service" with automatic restart. It also enables SOCKS5 proxy and arbitrary TCP port forwarding, turning the compromised host into a network pivot point. The package's README and loader provide false descriptions to evade detection and review.

Any system with this package installed or running should be considered fully compromised. The attacker gains full control over the host, including remote shell access, data exfiltration of sensitive credentials and files, persistence mechanisms, and the ability to pivot within the network. Secrets and keys stored on the compromised system are at high risk and should be rotated immediately from a secure environment. Removing the package alone does not guarantee removal of all malicious components due to the extensive post-installation compromise.

Immediate removal of the hydration-ui-dlx package is recommended. However, due to the high likelihood of full system compromise, all secrets, credentials, and keys stored on the affected system should be rotated from a different, trusted machine. A full forensic investigation and system rebuild may be necessary to ensure complete eradication of the implant and associated malware. No official patch or fix is available as this is a malicious package rather than a vulnerability in legitimate software.