Malicious code in @hd-team/app-dnpkg-eight (npm)

The npm package @hd-team/app-dnpkg-eight has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host computer, potentially granting attackers complete control. Due to the severity of the compromise, simply uninstalling the package may not be sufficient to remove all malicious artifacts. The advisory recommends rotating all secrets and keys from a different, uncompromised machine to mitigate potential credential theft or misuse.

Full system compromise on any computer with the package installed or running. Potential exposure and theft of all stored secrets and keys. The attacker may maintain persistent access beyond removal of the package.

Remove the @hd-team/app-dnpkg-eight package immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, secure computer. Because full control may have been given to an attacker, consider a full system rebuild or forensic analysis to ensure complete removal of malicious components.