OpenSSF/OSV advisory MAL-2026-4579 confirms this npm version as malicious. When `npx hpsetup <key>` runs, the tool fetches a tarball from `https://hpsetup-cdn.932324.xyz/api/tarball/<slug>/<version>?key=<userKey>` and extracts it directly into `node_modules/@heroui-pro/react` (or `heroui-native-pro`) with no hash check, no signature verification, and no version pin to a publisher origin (src/constants.js:16, src/download.js:24). The destination is a numeric `.xyz` subdomain unrelated to...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in hpsetup (npm)
Details
When `npx hpsetup <key>` runs, the tool fetches a tarball from `https://hpsetup-cdn.932324.xyz/api/tarball/<slug>/<version>?key=<userKey>` and extracts it directly into `node_modules/@heroui-pro/react` (or `heroui-native-pro`) with no hash check, no signature verification, and no version pin to a publisher origin (src/constants.js:16, src/download.js:24). The destination is a numeric `.xyz` subdomain unrelated to HeroUI's real publisher infrastructure, and the package itself ships no `homepage`, `repository`, or `author` fields linking it to heroui.com — yet it brands itself as the HeroUI Pro setup tool and writes into the `@heroui-pro` scope on the consumer's disk. Whatever bytes the CDN returns become the React component library required at runtime, giving the operator of `932324.xyz` arbitrary code execution in every consuming application. The user's license key (HEROUI_KEY / hp_xxx) is appended as `?key=<userKey>` to every CDN fetch, silently relaying paying-customer credentials to the lookalike host (src/download.js:24). After download, the tool patches `vercel.json` to set `installCommand: npx -y hpsetup@latest <userKey>` (src/vercel.js:18-29), pinning every future Vercel deployment to re-fetch code from the same `.xyz` CDN and re-send the key — non-interactive runs skip the prompt and apply this automatically. The downloaded tarball's `dist/postinstall/` directory and `scripts.postinstall` entry are silently scrubbed from the `package.json` before the package manager sees it (src/download.js:11-19), concealing whatever lifecycle script the CDN delivered from npm/pnpm/bun audit and trust prompts. Before any user prompt, the flow also patches `pnpm-workspace.yaml` allowBuilds / `pnpm.onlyBuiltDependencies` / `trustedDependencies` to auto-trust `@heroui-pro/react` and `heroui-native-pro` (src/install.js:80-92, src/trust.js:1), elevating the privilege of CDN-delivered code without consent. The combination — non-publisher mutable code drop, license-key exfiltration to that same host, CI persistence, postinstall concealment, and silent trust-store mutation — is unambiguous attacker infrastructure impersonating HeroUI Pro.