Executive brief
The hpmm package, distributed through npm, contains intentionally malicious code that steals system information and downloads/executes arbitrary files on affected computers. Any system with this package installed should be considered fully compromised, and all credentials and secrets stored on that system must be rotated immediately from a different, clean computer.
Technical details
All versions of the hpmm npm package contain embedded malicious code (CWE-506: Embedded Malicious Code). The package performs system reconnaissance by uploading system information to remote attacker-controlled servers, then downloads and executes arbitrary files with the privileges of the user running npm/Node.js. No authentication or user interaction is required—the malicious behavior triggers automatically upon installation or first import. Complete system compromise must be assumed, as the attacker gains the ability to execute arbitrary code in the package runtime context and may have installed persistent mechanisms beyond the package itself.
Affected products
- npm hpmm all versions
Timeline
- 2020-09-03: disclosed