MalwarePublished 9 Sep 2025Updated 1 Sep 2026

hrp987 (npm) · Malicious Code

Affects hrp987Source GCVE Database

What to do

Affected software

Product	Affected	Fixed in
npmhrp987	Affected >=1.0.0 =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'hrp987' contains malicious code that communicates with a domain linked to malicious activity. Installation or execution of this package can lead to a full compromise of the affected computer. Secrets and keys stored on the compromised system should be rotated immediately from a different, secure machine. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.

Impact

Systems with the 'hrp987' package installed or running are considered fully compromised, implying that attackers may have unauthorized control over the system. All stored secrets and keys on the affected system are at risk and should be rotated immediately. The presence of this package can lead to significant security breaches, data loss, or further malicious activity.

Defensive guidance

Remove the 'hrp987' package immediately from affected systems. Rotate all secrets and keys stored on the compromised machine from a different, secure computer. Due to the potential for persistent compromise, consider rebuilding the affected system or performing a thorough forensic analysis to ensure complete removal of malicious components.

Summary

The 'hrp987' package in the npm ecosystem is identified as malicious due to its communication with a domain associated with malicious activity. According to the source details, any system with this package installed or running should be considered fully compromised. The attacker may have gained full control over the system, making it necessary to rotate all secrets and keys from a separate secure environment. Removal of the package is recommended but may not guarantee complete remediation due to potential persistence mechanisms.

References

github.com/advisories/GHSA-wgc4-hm5f-vjx5 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Sep 2026, 10:53 UTC

Technical details

References

Community reviews