Malicious code in hydration-ui-pkg (npm)

The hydration-ui-pkg version 1.0.0 includes a raw x86_64 ELF binary named dist/internal/mathcalc.mjs, which is executed upon package import. This binary is a remote-access trojan implant (REDSHELL/SECURE_BEACON) that connects to a hardcoded C2 IP (217.60.77.63) and exfiltrates data to a remote URL. It supports operator commands for harvesting SSH private keys, credentials, and databases, streaming stolen data via HTTP POST requests. Additional ELF binaries and shellcode can be fetched and executed in memory without TLS encryption. Persistence is achieved by writing and enabling a systemd user service named svc-update.service. The package employs deliberate deception through extension mismatches, a fake stub function, and hardcoded non-first-party C2 infrastructure, confirming intentional trojanization.

This malicious package enables attackers to gain remote access to affected systems, steal sensitive credentials and databases, execute arbitrary code in memory, and maintain persistent access through systemd services. The presence of this implant on a system compromises confidentiality, integrity, and availability of the environment where the package is installed.

No official patch or remediation is currently documented. Users should immediately remove the hydration-ui-pkg version 1.0.0 from their environments. Verify that no persistence mechanisms (such as systemd user services named svc-update.service) remain active and investigate for potential data exfiltration. Monitor for any connections to the hardcoded C2 IP 217.60.77.63 or the exfiltration URL. Since this is a malicious package, avoid using hydration-ui-pkg version 1.0.0 entirely.