LWA-2026-11672 MAL-2026-14569 ↗ confirmed malware

@hd-team/app-dnpkg-beta@1.0.20260828054000

Malicious code in @hd-team/app-dnpkg-beta (npm)

Analysis

Package @hd-team/app-dnpkg-beta@1.0.20260828054000 was published to the npm registry and then immediately unpublished, leaving no downloadable content available for analysis. The version string is a timestamp (1.0.20260828054000) on a scoped package name. This publish-and-yank pattern is consistent with a package being briefly exposed then withdrawn; no payload, network endpoints, or code artifacts could be recovered to characterize further. Analysis is metadata-only.

analyzed by
Leitwacht
first seen
Aug 27, 2026, 09:47 PM
analyzed
Aug 27, 2026, 09:47 PM
weekly installs
199,390

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.