registry / hydration-ui-cls / 1.0.0

hydration-ui-cls@1.0.0

Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store.

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Importing the default package entry executes a detached bundled ELF. Static inspection of that ELF shows remote payload delivery, credential collection, persistence, and exfiltration functionality.

Static reason

No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Import hydration-ui-cls

Impact

Remote code execution, credential theft, persistence, and data exfiltration.

Mechanism

Import-time execution of a bundled malicious ELF

Attack narrative

A normal import invokes an async initializer that verifies, chmods, and detached-spawns calc-eng.dat. The bundled hash is explicitly allowlisted by the source. Static binary strings disclose C2-oriented commands to download and execute ELF payloads, collect SSH keys and browser credential stores, establish cron/bashrc/systemd/XDG persistence, and upload collected files.

Rationale

This is concrete import-time execution of a bundled malicious native payload, not a package-aligned accelerator. No lifecycle hook is needed for the payload to activate when the advertised module is imported.

Evidence

package.jsondist/index.mjsdist/internal/calc-eng.datdist/internal/daymath.mjs/tmp/proc/self/fd~/.ssh~/.config/etc/ssh

Network endpoints3

api.ipify.org/resources/internals/api.php

hydration-ui-cls@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code