Executive brief
hulp is a Node.js npm package that was intentionally published with malicious code embedded as a preinstall script. When installed, the package contacts an external command-and-control server and executes arbitrary commands on the compromised machine. Any system where this package has been installed must be considered fully compromised and requires immediate remediation including credential rotation and complete system audit.
Technical details
The hulp npm package contains malicious code (CWE-506: Embedded Malicious Code) embedded in its preinstall script. When the package is installed via npm, the preinstall script automatically executes and establishes communication with an external command-and-control (C2) server over the network. The attacker gains arbitrary code execution on the victim machine with the privileges of the user running npm install, enabling data exfiltration, credential theft, lateral movement, and persistent compromise. No patch is available; the only mitigation is to avoid installation and to immediately remove the package from any affected systems while being aware that full system compromise may have already occurred.
Affected products
- npm hulp all versions
Timeline
- 2020-09-02: disclosed