Supply chain · npm · High

Critical Malware in npm Package @hd-team/app-impkg-test Poses Full System Compromise

Threat Engine Auto-Feed · data current as of 2026-08-27

The npm package '@hd-team/app-impkg-test' has been identified as malicious, leading to full system compromise upon installation. This critical threat necessitates immediate action, including secret rotation and system re-imaging, due to potential persistent attacker control.

  • Package: npm / @hd-team/app-impkg-test
  • Affected versions: >= 0
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

A malicious version of the npm package '@hd-team/app-impkg-test' was published, designed to compromise any system where it is installed or executed. The advisory indicates that installation grants an outside entity full control over the affected computer.

How the attack works

This is a supply-chain attack where a seemingly legitimate software package is compromised to deliver malicious capabilities. Upon installation, the package executes code that establishes persistent access and control for an attacker, potentially leading to credential and secret theft.

Who's exposed

Profiles most at risk

  • Development teams using npm
  • CI/CD pipelines that pull npm dependencies
  • Any organization with systems that have installed '@hd-team/app-impkg-test'

Conditions that increase exposure

  • Unpinned dependencies in package.json allowing automatic updates to malicious versions
  • Lack of package-lock.json or yarn.lock to ensure consistent dependency resolution
  • Internal package mirrors that have synchronized the malicious package
  • Automated build processes that install dependencies without prior vetting

Blast-radius scenarios

  • An attacker gains full control over the compromised system, enabling data exfiltration, further lateral movement, or deployment of additional malware.
  • All secrets, keys, and sensitive data stored on the compromised computer are at risk of theft.
  • The integrity of development environments and build artifacts may be compromised, leading to further supply chain risks.

What to do (defensive)

Detect

  • Scan dependency trees for '@hd-team/app-impkg-test' across all projects and environments.
  • Review package-lock.json or yarn.lock files for the presence of the malicious package.
  • Monitor network traffic for unusual outbound connections from systems that might have installed the package.

Contain

  • Immediately isolate any system identified with '@hd-team/app-impkg-test' installed.
  • Block the malicious package from being downloaded or installed in your environment.
  • Review and update dependency policies to pin versions and use lock files consistently.

Remediate

  • Consider any computer with '@hd-team/app-impkg-test' installed as fully compromised and re-image it from a trusted source.
  • Rotate all secrets and keys (e.g., API keys, SSH keys, access tokens) that were stored on or accessible from the compromised computer, performing this action from a different, trusted machine.
  • Remove the package from all environments, but acknowledge that this alone may not fully remove all malicious software.

Frontier verdict — High

This critical npm package compromise requires immediate system isolation, re-imaging, and comprehensive secret rotation due to full system control by an attacker.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.