Malicious code in @hd-team/app-dnpkg-test (npm)

The npm package @hd-team/app-dnpkg-test is identified as containing malicious code that fully compromises the host computer upon installation or execution. This results in potential unauthorized access and control by an external entity. Due to the severity of the compromise, secrets and keys stored on the affected machine must be rotated from a separate, secure environment. The package removal does not guarantee eradication of the malicious software or backdoors introduced by the attacker.

Full compromise of the affected computer, including potential unauthorized access to all stored secrets and keys. The attacker may maintain persistent control beyond the presence of the malicious package itself, posing a significant risk to system integrity and confidentiality.

Immediately remove the @hd-team/app-dnpkg-test package from affected systems. Rotate all secrets and keys that were stored on the compromised computer using a different, secure machine. Consider the affected system fully compromised and perform a thorough investigation and remediation, including potential system rebuilds, to ensure complete removal of malicious artifacts.