MAL-2026-4579 Malicious code in hpsetup (npm)

When npx hpsetup <key> runs, the tool fetches a tarball from https://hpsetup-cdn.932324.xyz/api/tarball/<slug>/<version>?key=<userKey> and extracts it directly into node_modules/@heroui-pro/react (or heroui-native-pro) with no hash check, no signature verification, and no version pin to a publisher origin (src/constants.js:16, src/download.js:24). The destination is a numeric .xyz subdomain unrelated to HeroUI's real publisher infrastructure, and the package itself ships no homepage, repository, or author fields linking it to heroui.com — yet it brands itself as the HeroUI Pro setup tool and writes into the @heroui-pro scope on the consumer's disk. Whatever bytes the CDN returns become the React component library required at runtime, giving the operator of 932324.xyz arbitrary code execution in every consuming application. The user's license key (HEROUI_KEY / hp_xxx) is appended as ?key=<userKey> to every CDN fetch, silently relaying paying-customer credentials to the lookalike host (src/download.js:24). After download, the tool patches vercel.json to set installCommand: npx -y hpsetup@latest <userKey> (src/vercel.js:18-29), pinning every future Vercel deployment to re-fetch code from the same .xyz CDN and re-send the key — non-interactive runs skip the prompt and apply this automatically. The downloaded tarball's dist/postinstall/ directory and scripts.postinstall entry are silently scrubbed from the package.json before the package manager sees it (src/download.js:11-19), concealing whatever lifecycle script the CDN delivered from npm/pnpm/bun audit and trust prompts. Before any user prompt, the flow also patches pnpm-workspace.yaml allowBuilds / pnpm.onlyBuiltDependencies / trustedDependencies to auto-trust @heroui-pro/react and heroui-native-pro (src/install.js:80-92, src/trust.js:1), elevating the privilege of CDN-delivered code without consent. The combination — non-publisher mutable code drop, license-key exfiltration to that same host, CI persistence, postinstall concealment, and silent trust-store mutation — is unambiguous attacker infrastructure impersonating HeroUI Pro.