The hunsterx-package version 7.0.1 includes a preinstall.js script that runs obfuscated payloads decoding base64-encoded commands to collect host information (hostname, user info, current directory, network interfaces), full environment variables (including sensitive API keys and credentials), npm tokens from .npmrc files, AWS EC2 instance metadata via IMDSv2, and recursively reads configuration files (*.env, *.config, *.yaml, *.toml). This data is exfiltrated using HTTPS and DNS requests to a domain controlled by the attacker. A postinstall.js script performs a DNS callback to confirm execution of installation lifecycle phases. The obfuscation via base64 and eval is intended to evade static code review. The impact includes leakage of sensitive secrets and potential full system compromise.

Systems that run npm install on hunsterx-package 7.0.1 leak sensitive environment variables, npm publish tokens, AWS account identifiers, and configuration files to an attacker. This can lead to unauthorized access to cloud resources, code repositories, and CI/CD pipelines. The attacker may gain persistent control over the compromised system. Removal of the package alone does not guarantee elimination of all malicious artifacts or backdoors. Immediate secret and key rotation is required to mitigate ongoing risk.

No official patch or fix is currently documented. Users should immediately remove hunsterx-package version 7.0.1 from their projects and environments. All secrets, API keys, npm tokens, and cloud credentials exposed on affected systems must be rotated from a secure, uncompromised environment. Consider rebuilding compromised systems to ensure removal of any persistent malicious components. Monitor for any suspicious network activity related to the exfiltration domains described. Avoid using this package until a trusted, clean version is available.