Malicious code in @hd-team/app-dnpkg-three (npm)

The npm package @hd-team/app-dnpkg-three has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host computer, potentially allowing attackers to access all stored secrets and keys. Due to the nature of the compromise, removal of the package alone is insufficient to ensure system integrity, as additional malicious software may have been installed. Immediate secret rotation from a different, uncompromised system is advised.

Full system compromise on any computer with the package installed or running. All stored secrets and keys on the affected system are at risk and should be considered compromised. Persistence of malicious software beyond the package itself is likely, making remediation difficult without a full system rebuild or thorough investigation.

Remove the @hd-team/app-dnpkg-three package immediately. Rotate all secrets and keys stored on the affected system using a separate, trusted computer. Because the system may be fully compromised, consider rebuilding the system or performing a comprehensive forensic analysis to ensure all malicious components are eradicated. No official patch or fix is available; remediation relies on removal and secret rotation.