The jscrambler-metro-plugin package version 9.0.2 distributed via npm contains embedded malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker complete control. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors. The threat is classified as a malicious package rather than a traditional vulnerability, and no CVSS score is assigned.

Any system with jscrambler-metro-plugin version 9.0.2 installed or running is considered fully compromised. This includes potential unauthorized access, data exfiltration, and persistent control by an attacker. All secrets and keys stored on the compromised system are at risk and should be rotated from a secure, unaffected environment. The compromise may extend beyond the package itself, making remediation complex.

Remove the jscrambler-metro-plugin package version 9.0.2 immediately from all affected systems. Rotate all secrets and keys that were stored or used on the compromised machines, performing this rotation from a different, secure system. Because the system may be fully compromised, consider rebuilding or restoring from a known good backup rather than relying solely on package removal. No official patch or fix is available; remediation relies on removal and secret rotation.