MalwarePublished 23 Jun 2026Updated 15 Jul 2026

hashd-edu (npm) · Malicious Code

Affects hashd-eduSource GCVE Database

Malicious package : remove hashd-edu and rotate any secrets on hosts that installed it.

Data as of 15 Jul 2026, 12:44 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6302

What to do

Remove hashd-edu from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmhashd-edu	Affected 1.0.0 – 1.0.5 5 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package hashd-edu contains malicious code that installs a remote shell backdoor. This backdoor activates both during installation and when the module is loaded, establishing communication with a hardcoded attacker server. It sends system identifiers and periodically polls for commands to execute, sending back command output. Any system with this package installed or running should be considered fully compromised. Immediate removal of the package and rotation of all secrets and keys is recommended, although full remediation may require a complete system rebuild due to potential persistent compromise.

Impact

Systems with hashd-edu installed or running are fully compromised, allowing attackers remote code execution and persistent control. All secrets and keys on the affected system should be considered exposed and must be rotated from a separate, trusted environment. Removing the package alone may not eliminate the attacker presence due to the backdoor's persistence and potential additional malware.

Defensive guidance

Remove the hashd-edu package immediately from all affected systems. Rotate all secrets, credentials, and keys from a secure, uncompromised environment. Because the backdoor grants full control to attackers, consider rebuilding or thoroughly cleaning affected systems to ensure complete removal of malicious code. Monitor for any signs of persistent compromise.

Summary

The hashd-edu npm package versions 1.0.0, 1.0.1, 1.0.2, 1.0.4, and 1.0.5 include a malicious remote shell backdoor. The postinstall.js script forks a detached daemon that registers the infected machine with an attacker-controlled server and polls it every 30 seconds for commands, executing them via child_process.exec() and returning output. The main module index.js contains the same command-and-control logic, so requiring the package triggers the backdoor. This unconditional reverse-shell beacon to a hardcoded IP compromises any system using the package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 15 Jul 2026, 12:44 UTC

Technical details

References

Community reviews