MAL-2026-15900 Malicious code in hydration-ui-pkg (npm)

Package main (dist/index.mjs) locates dist/internal/mathcalc.mjs — a raw x86_64 ELF binary shipped under an.mjs extension and described in the README as a 'native math accelerator' — chmods it to 0755, verifies a pinned SHA-256, and spawns it detached via child_process.spawn on any require/import of the package. daymath.mjs contains a stub function with a comment stating it exists to make the math functions 'look like they rely on the binary', confirming the cover story. The ELF is a full remote-access implant (REDSHELL/SECURE_BEACON) that beacons to hardcoded C2 IP 217.60.77.63 and exfiltrates to https://litterbox.catbox.moe/resources/internals/api.php. Operator commands include /ssh_keys, /creds, /dbfind, /download and /dataextract for harvesting installer SSH private keys, credentials and databases, streamed chunked to POST /api/extract-receive. /redshell elf and /redshell bin fetch additional ELFs and shellcode over TLS-disabled HTTP into memfd (memfd_create syscall 319) or /tmp/.elf_XXXXXX and /tmp/.sc_XXXXXX for in-memory execution. /redshell persist writes ~/.config/systemd/user/svc-update.service (Description=System Update Service, Restart=always) and enables it via systemctl –user for login persistence. Extension-mismatched ELF, fake dependency stub, cover-story README, and hardcoded non-first-party C2 confirm intentional trojanization.