The hashd-edu npm package versions 1.0.0, 1.0.1, 1.0.2, 1.0.4, and 1.0.5 include a malicious remote shell backdoor. The postinstall.js script forks a detached daemon that registers the infected machine with an attacker-controlled server and polls it every 30 seconds for commands, executing them via child_process.exec() and returning output. The main module index.js contains the same command-and-control logic, so requiring the package triggers the backdoor. This unconditional reverse-shell beacon to a hardcoded IP compromises any system using the package.

Systems with hashd-edu installed or running are fully compromised, allowing attackers remote code execution and persistent control. All secrets and keys on the affected system should be considered exposed and must be rotated from a separate, trusted environment. Removing the package alone may not eliminate the attacker presence due to the backdoor's persistence and potential additional malware.

Remove the hashd-edu package immediately from all affected systems. Rotate all secrets, credentials, and keys from a secure, uncompromised environment. Because the backdoor grants full control to attackers, consider rebuilding or thoroughly cleaning affected systems to ensure complete removal of malicious code. Monitor for any signs of persistent compromise. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.