Executive brief
The hsf-clients npm package contains malicious code that silently collects system information, downloads remote files, and executes them without user consent. Any system with this package installed should be considered fully compromised; all credentials and encryption keys must be rotated immediately from a different trusted computer.
Technical details
All versions of hsf-clients contain embedded malicious code classified as CWE-506 (embedded malicious code). The package performs reconnaissance by uploading system information to an attacker-controlled server, then downloads and executes arbitrary code, granting remote code execution and full system compromise. The attack requires no authentication or user interaction—installation alone is sufficient for exploitation. Once installed, the malware may persist beyond package removal due to arbitrary code execution capabilities, making complete remediation uncertain without a full system rebuild.
Affected products
- npm hsf-clients all versions
Timeline
- 2020-09-03: disclosed