dims-hydration-ui@1.0.0

Analysis

dims-hydration-ui@1.0.0 is a decoy "calendar streak computation" library that ships an ELF binary at dist/internal/calc.dat disguised as a native math accelerator. Importing the package spawns this binary detached. The binary is a red-team C2 implant: it provides a remote shell (/redshell elf <file> | elf -inject <pid> <file>) with process injection, port forwarding (/portfwd start <lport> <rhost> <rport>), and tunneling (/tunnel open|relay|clo). It downloads and executes second-stage payloads from hxxp://217[.]60[.]77[.]63:<port>/Others/<name> and hxxp://217[.]60[.]77[.]63:<port>/SC/<name>, performs external-IP discovery via api[.]ipify[.]org, uses DNS 8[.]8[.]8[.]8, and communicates over TLS. It drops hidden files under /tmp/.sk, /tmp/.cr, and /tmp/.elf_XXXXXX and supports memfd-based shellcode execution.