registry / hydration-cls-ui / 1.0.0

hydration-cls-ui@1.0.0

Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store.

AI Security Review

scanned 48m ago · by lpm-firewall-ai

Importing the package root executes its bundled ELF binary after making it executable. The binary contains backdoor, credential-theft, remote-payload, and persistence functionality unrelated to the advertised date utilities.

Static reason

No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Importing hydration-cls-ui at runtime.

Impact

Remote command execution, credential theft, data exfiltration, and persistence.

Mechanism

import-time detached execution of a bundled malicious ELF

Attack narrative

A normal import runs dist/index.mjs, which verifies, chmods, and detached-spawns calc.dat. Static inspection of that ELF shows a Linux backdoor with network/TLS support, payload download and execution, SSH-key and browser-credential collection, file upload, shell commands, and several persistence mechanisms. The JavaScript date functions only use pure JS and do not require this binary.

Rationale

The import-time executable is concrete, unrelated to the package purpose, and contains explicit malware capabilities. No install hook is needed for impact because ordinary application import triggers it.

Evidence

package.jsondist/index.mjsdist/internal/calc.datdist/internal/daymath.mjsdist/store.mjs

Network endpoints3

217.60.77.63api.ipify.org/resources/internals/api.php

hydration-cls-ui@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code