{"answers":{"affected":"1 open source package ship an affected version, including hydration-ui-dim.","exploited":"There is no known exploitation of MAL-2026-14431 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14431 is a malicious package in hydration-ui-dim, published on 24 Aug 2026."},"fix_prompt":"MAL-2026-14431 is a malicious package: hydration-ui-dim (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14431/ (Markdown: https://insights.sbomify.com/MAL-2026-14431/index.md)","id":"MAL-2026-14431","markdown":"https://insights.sbomify.com/MAL-2026-14431/index.md","name":"MAL-2026-14431","record":{"aliases":["GHSA-79qw-ww45-gpfp"],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On `import 'hydration-ui-dim'`, dist/index.mjs runs a top-level async IIFE that chmods dist/internal/calc-math.dat to 0755 and spawns it detached via child_process. The file is a Linux x86_64 ELF, not a math accelerator; the package's stated purpose is pure-JS calendar-day/streak math and requires no native binary. The bundled ELF is a full remote-control agent: it beacons over TLS to hardcoded IP 217.60.77.63 with a 'REDSHELL' / 'SECURE_BEACON' tag, dispatches network-sourced commands into /bin/sh and /bin/bash, and exposes an operator command set including /sysinfo, /ps, /env, /ls, /cat, /download, /upload, /ssh_keys, /creds, /dbfind, /dataextract, /clipboard, /spawn, and /adduser. It fetches second-stage payloads over plain HTTP from /Others/ and /SC/ endpoints on the C2 and executes them, including an in-memory memfd_create path (syscall 319) to run downloaded ELFs without touching disk, with a /tmp/.elf_XXXXXX fallback. A /redshell persist command writes ~/.config/systemd/user/svc-update.service (Description='System Update Service', Restart=always) and enables it via `systemctl --user enable --now`, providing boot-time persistence under the installing user. Harvested filesystem trees, SSH keys, credential stores, database files, clipboard contents, and environment variables are chunked and uploaded via `POST /api/extract-receive` framed with BIGEXTRACT_START/BIGEXTRACT_END markers. The ELF is disguised via a 'native math accelerator' cover story and a hardcoded SHA-256 'integrity verification' constant, but the JS math primitives are self-contained and never call into the binary.\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in hydration-ui-dim (npm)","id":"MAL-2026-14431","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":["0"],"last_affected":[],"package":"hydration-ui-dim","purl":"pkg:npm/hydration-ui-dim","source":"MAL-2026-14431"}],"products":null,"published":"2026-08-24","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14431/"}