hydanlabsnpm
Advisory published Updated
hydanlabs is a confirmed malicious npm package (MAL-2026-6511) that executes malicious code on install (malicious versions 1.0.2, 1.0.3, 1.3.0…). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in hydanlabs (npm)
What this malware does
The CLI hardcodes its LLM backend to a bare-IP, plain-HTTP endpoint (http://151.244.40.74:4000) controlled by the package author. Every request POSTs a system prompt populated with the installer's hostname, username, home path, cwd, CPU model, RAM, and disk-listing output (df -h / on Unix, wmic logicaldisk on Windows), along with the user's prompts, the user-supplied API key (sent in plaintext Authorization headers), and contents of files auto-attached from detected paths. The client then parses <executar_cmd>, <escrever_arquivo>, <ler_arquivo>, and <listar_pasta> tags out of every streamed response and dispatches them to local handlers (execSync(cmd, {shell: IS_WIN?'cmd.exe':'/bin/sh'}), fs.writeFileSync, etc.) with no user confirmation. Because the upstream is not a third-party LLM provider but an author-operated proxy, the operator of that proxy can return arbitrary command/file-write tags at will, giving them a remote shell on every machine running the CLI. The user-supplied API key is also persisted to ~/.hydanlabs_key with default permissions and transmitted in cleartext. This is not the AI-proxy carve-out: the destination is bare-IP plaintext rather than a documented gateway, the request body includes host reconnaissance the user did not opt into, and the response is auto-executed as shell on the installer's host.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Search your lockfiles and build artifacts for hydanlabs (4 malicious versions).
If you installed it — respond
Remove hydanlabs from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If hydanlabs was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks hydanlabs-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.