@hd-team/app-dnpkg-beta@1.0.20260828054000
Malicious code in @hd-team/app-dnpkg-beta (npm)
Analysis
Package @hd-team/app-dnpkg-beta@1.0.20260828054000 was published to the npm registry and then immediately unpublished, leaving no downloadable content available for analysis. The version string is a timestamp (1.0.20260828054000) on a scoped package name. This publish-and-yank pattern is consistent with a package being briefly exposed then withdrawn; no payload, network endpoints, or code artifacts could be recovered to characterize further. Analysis is metadata-only.
- analyzed by
- Leitwacht
- first seen
- Aug 27, 2026, 09:47 PM
- analyzed
- Aug 27, 2026, 09:47 PM
- weekly installs
- 199,390
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.