@hd-team/app-dnpkg-beta @1.0.20260808153500

Summary

The tarball contains only package.json and index.js. index.js is not JavaScript source: it is a base64-encoded JSON blob that decodes to a configuration object containing a cdn field whose value base64-decodes to the string 'funnull' (a CDN provider previously sanctioned for hosting malicious content), a domain field of https://apiyf.dq87771.com, an additional endpoint https://api.dq87771.com, and a hardcoded token (800cf3d509b44bf7bfd32529dc3ff597). The package declares no lifecycle scripts and index.js is not valid JavaScript, so npm install and require() of this package alone do not execute code. The shape — a non-functional package that carries only remote-configuration data pointing at Funnull-tagged infrastructure and an authentication token — is consistent with the config half of a two-package loader/config split, where a companion package reads this configuration to fetch and execute payloads from the referenced hosts.

Source: amazon-inspector (8f5be2650e129e66738602f02b893ba443ffbd9a47df685f76bd4ae84b885529)