Malicious code in @hd-team/app-dnpkg-beta (npm)

The @hd-team/app-dnpkg-beta npm package contains only a package.json and an index.js file, where index.js is not valid JavaScript but a base64-encoded JSON blob. This configuration object includes references to a CDN provider (Funnull) known for hosting malicious content, two malicious endpoints, and a hardcoded authentication token. The package declares no lifecycle scripts and does not execute code by itself, suggesting it serves as a configuration component in a two-package loader/config split. A companion package likely uses this configuration to retrieve and execute malicious payloads from the indicated hosts. This design indicates a supply chain attack vector through npm packages.

Systems with this package installed are considered fully compromised. Attackers may have gained full control, potentially accessing all secrets and keys stored on the affected computer. Because the package itself does not execute code directly, the compromise likely occurs when combined with a companion package that fetches and runs malicious payloads. Simply removing this package may not remove all malicious components or backdoors introduced by the attacker.

Immediate removal of the @hd-team/app-dnpkg-beta package is recommended. All secrets, credentials, and keys on the affected system should be rotated from a trusted, uncompromised environment. Due to the high likelihood of full system compromise, a thorough incident response and system rebuild or forensic analysis should be considered. There is no official patch or fix since this is a malicious package rather than a vulnerability in legitimate software.