Malicious code in hs-locale-management (npm)

This threat involves a malicious npm package named hs-locale-management, published under a high version number (99.99.99 and variants) to outrank legitimate internal packages in HubSpot's namespace. The package's postinstall.js script collects local system fingerprinting information (hostname, username, platform, node version, process ID) and outputs it to stdout. It does not currently exfiltrate data over the network, drop additional payloads, or modify the installer's filesystem beyond its own directory. The main concern is structural: the package's naming and versioning could be exploited in supply-chain attacks if future versions include more harmful code. The current version's impact is limited and does not meet criteria for blocking, but the package represents namespace abuse and should be subject to takedown or reservation actions. Vendor advisories or patches are not indicated, and the package is not a cloud service. The GHSA advisory warns that any system with this package installed should be considered fully compromised and recommends immediate secret/key rotation and package removal.

The immediate impact of the current package versions is limited to local fingerprint data collection and console output during installation, with no network exfiltration or filesystem modifications outside the package directory. However, the structural risk is significant: the package's high version number and namespace squatting could allow attackers to deliver arbitrary malicious code in future versions, potentially leading to full system compromise. The GHSA advisory treats any system with this package installed as fully compromised, recommending secret rotation and removal. No known exploits in the wild are reported at this time.

No official patch or remediation is currently available. Users and organizations should remove any installed versions of hs-locale-management (versions =99.99.99, =99.99.99-poc2, =99.99.99-poc3) immediately. Rotate all secrets and keys from a separate, trusted system to mitigate potential compromise. Monitor for any future advisories or takedown actions related to this package. Registry maintainers and HubSpot should consider namespace reservation or takedown to prevent reuse of this high-version package name. Since this is not a cloud service, remediation depends on user action.