The workspace-lint package in the npm ecosystem has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, allowing attackers to potentially access all stored secrets and keys. Due to the nature of the compromise, simply uninstalling the package does not ensure removal of all malicious artifacts. This threat is categorized as a malicious package rather than a traditional vulnerability and does not have an associated CVSS score.

Any system with the workspace-lint package installed or running should be considered fully compromised. Attackers may have gained full control over the system, including access to sensitive secrets and keys. This can lead to unauthorized data access, credential theft, and further system compromise. The persistence of malicious code beyond the package itself means that the system's integrity cannot be assured by package removal alone.

Remove the workspace-lint package immediately from all affected systems. Rotate all secrets and keys stored on the compromised systems using a separate, trusted device. Because the system may remain compromised even after package removal, consider rebuilding or restoring the system from a known clean backup. Monitor for any suspicious activity and apply organizational incident response procedures.