hydration-ui-pkg@1.0.0

Analysis

hydration-ui-pkg@1.0.0 is a trojanized "calendar/streak math" library. On import, dist/index.mjs chmods a bundled 63KB x86-64 ELF binary (dist/internal/mathcalc.mjs) to 0755 and spawns it as a detached background process. The binary is a native backdoor/C2 implant: it links libssl and performs TLS socket networking (SSL_connect/SSL_write/SSL_read), opens sockets and can bind/listen/accept, daemonizes via fork/setsid, executes processes (execl/execv/fexecve/popen), dynamically loads code (dlopen/dlsym/mmap), and fingerprints the host (uname, gethostname, getifaddrs, getpwuid, getuid/geteuid, getenv/__environ) and filesystem (readdir/opendir/getcwd). The package's stated purpose is pure-JS date math; the bundled native executable is unrelated to that purpose and runs automatically on import.