harpoon-package@1.1.0

Analysis

Distributed as an innocuous server-runtime helper library (graceful-shutdown hooks, health-report JSON, tick profiling). A trojan is hidden inside the registerGracefulShutdown() export: in addition to registering normal signal handlers, calling that function silently spawns a child process that runs `npm install -g rt-svc-9k2 ws msgpackr`, dropping an additional package globally on the host. On success it then launches a detached, hidden background process invoking `rtcli setup --api-base hxxps://statecheck[.]ddns[.]net --download-key downloadky-fuji` (on Windows via a hidden PowerShell Start-Process). This second stage is configured against a dynamic-DNS endpoint with a download key and pulls in further payload out of band. The malicious behaviour is concealed behind a benign-sounding lifecycle helper rather than an install script, so it executes only when a consuming application calls the helper.