Threats Tagged 'mal-2026-6394'

The hs-locale-management package on npm was found to contain malicious code published as a dependency-confusion proof-of-concept under version 99.99.99 and related tags. The package's postinstall script collects local host fingerprint data and prints it to the console without exfiltrating data or modifying files outside its own directory. While the current version's impact is limited to harmless console output, the package's naming and versioning pose a supply-chain risk because it could be used to deliver arbitrary code in future versions if mistakenly resolved by HubSpot's internal build pipelines or third parties. There is no confirmed patch or remediation available at this time. The package should be removed if installed, and secrets rotated as a precaution due to the potential for full system compromise.