The lowkeybored package in the npm ecosystem is identified as malicious software. Installation or execution of this package results in a full system compromise, allowing attackers to potentially access and control the affected computer. The advisory strongly recommends immediate rotation of all secrets and keys from a separate, uncompromised system. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious components or backdoors introduced.

Any system with the lowkeybored package installed or running is considered fully compromised. Attackers may have obtained full control over the system and access to all stored secrets and keys. This poses a severe risk to confidentiality, integrity, and availability of the affected system and its data. The compromise may persist even after removal of the package.

Remove the lowkeybored package immediately. Rotate all secrets and keys from a different, uncompromised computer to prevent unauthorized access. Because the system may be fully compromised, consider rebuilding or restoring the system from a known good backup to ensure complete removal of malicious software.