dim-hydration-ui
Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store.
This report shows the evidence for dim-hydration-ui@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package executes an opaque, network-capable native binary during ordinary import and detaches it from the host process. The visible JavaScript functionality does not require that binary.
Static reason
No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Importing dim-hydration-ui
Impact
Opaque native code with observed TLS, networking, process, filesystem, and environment capabilities runs without an explicit user command.
Mechanism
Import-time permission change and detached native-binary execution
Attack narrative
The root entrypoint runs on import, marks dist/internal/math.bin executable, verifies its bundled hash, then starts it detached while discarding stdout and stderr. The exported date utilities are implemented in JavaScript and explicitly describe the binary linkage as a placeholder. Static inspection of the shipped stripped ELF shows TLS, socket, process-launch, filesystem-enumeration, and environment-access imports, capabilities not justified by calendar bucketing. This is an opaque active payload rather than an inert artifact.
AI rationale
The package executes an opaque, network-capable native binary during ordinary import and detaches it from the host process. The visible JavaScript functionality does not require that binary.
Evidence
package.jsondist/index.mjsdist/internal/daymath.mjsdist/internal/math.bin
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- Root import changes and launches bundled ELF binary.
- Spawn is detached and its output is discarded.
- Binary is unrelated to exported JavaScript date helpers and imports TLS, socket, process, filesystem, and environment APIs.
Evidence against
- package.json has no lifecycle scripts.
- The visible date-math implementation is pure JavaScript.
- The shipped binary matches the package's pinned SHA-256.
Behavioral surface
ChildProcessCryptoFilesystemShell
Source & flagged code
5 flagged · loading sourcedist/internal/math.binView file
•path = dist/internal/math.bin
kind = native_binary
sizeBytes = 63616
magicHex = [redacted]
Medium
dist/index.mjsView file
•matchType = malicious_source_fingerprint_signature
signature = 5501fa102f254897
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = hydration-ui-dim@1.0.0
matchedPath = dist/index.mjs
matchedIdentity = npm:aHlkcmF0aW9uLXVpLWRpbQ:1.0.0
similarity = 1.000
shingleOverlap = 2
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/index.mjsView on unpkg24(async () => {
try {
const __dirname = path.dirname(fileURLToPath(import.meta.url));
const binaryPath = path.join(__dirname, 'internal', 'math.bin');
Findings
4 High1 Medium1 Low
HighKnown Malware Source Fingerprint Signaturedist/index.mjs
HighAi Review Evidencedist/index.mjs
HighAi Review Evidencedist/index.mjs
HighAi Review Evidencedist/index.mjs
MediumShips Native Binarydist/internal/math.bin
LowFilesystem
Affected versions and remediation
This report applies to dim-hydration-ui@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing dim-hydration-ui@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.