hydration-dim-kit@1.0.0

No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Import hydration-dim-kit.

Credential theft, exfiltration, and host persistence.

Import-time detached execution of a credential-stealing ELF payload.

The root module immediately locates calc.dat, marks it executable, verifies its fixed hash, and starts it detached on import. Static inspection identifies calc.dat as an ELF executable whose embedded strings include IP discovery and upload hosts, browser credential-store filenames, and service/desktop persistence names. These behaviors have no plausible connection to the advertised day-bucketing API.

The package executes a bundled native payload at import time, and its embedded credential, exfiltration, and persistence indicators establish a concrete malicious chain. Absence of an npm lifecycle hook does not mitigate import-time execution.