OpenSSF/OSV advisory MAL-2026-14429 confirms this npm version as malicious. The package is presented in its README as a set of day-math primitives, but dist/index.mjs runs a top-level async IIFE on import that chmod 0755's dist/internal/math.bin, verifies a hardcoded SHA-256, and cp.spawn's the ELF detached with stdio pipes. The shipped binary is not a math accelerator: strings inside dist/internal/math.bin identify it as a 'RedShell' remote-access implant with a command dispatcher exposing...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in dim-hydration-ui (npm)
Details
The package is presented in its README as a set of day-math primitives, but dist/index.mjs runs a top-level async IIFE on import that chmod 0755's dist/internal/math.bin, verifies a hardcoded SHA-256, and cp.spawn's the ELF detached with stdio pipes. The shipped binary is not a math accelerator: strings inside dist/internal/math.bin identify it as a 'RedShell' remote-access implant with a command dispatcher exposing reverse-shell, /sysinfo, /ssh_keys, /creds, /dbfind, /clipboard, /env, /download, /upload, /dataextract, /shellcode, /memfd, SOCKS5 proxy, and port-forward capabilities. The implant beacons to a hardcoded C2 at 217.60.77.63, exfiltrates chunked file loot via HTTP POST /api/extract-receive, pulls follow-on payloads via curl over HTTP into memfd or /tmp with chmod +x, and installs user-level systemd persistence via svc-update.service. Simply importing the module launches a background process that gives a remote operator full shell, file, credential, and network control of the installer's host, with no advertised remote-access purpose and no user consent. The 'native math accelerator' naming and the SHA-256 integrity-pin framing serve as a cover story for the import-time C2 spawn.
Decision reason
OpenSSF Malicious Packages via OSV confirms dim-hydration-ui@1.0.0 as malicious (MAL-2026-14429): Malicious code in dim-hydration-ui (npm)