Threats Tagged 'mal-2026-14569'

The npm package @hd-team/app-dnpkg-beta contains a non-functional index.js file that is a base64-encoded JSON configuration pointing to infrastructure associated with a previously sanctioned malicious CDN provider, Funnull. The package itself does not execute code upon installation or require, but it appears to be part of a two-package loader/config scheme where a companion package could use this configuration to fetch and execute malicious payloads. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated immediately. Removal of the package alone may not eliminate all malicious software resulting from its installation.