The npm package redis-xyz version 1.1.4 has been identified as containing malicious code or relying on a dependency that contains malicious code. According to sources including Amazon Inspector and GHSA malware advisories, any system with this package installed or running should be considered fully compromised. The malicious code may grant an attacker full control over the system, risking exposure of all stored secrets and keys. Removal of the package alone may not remove all malicious artifacts, indicating persistent compromise.

Systems with redis-xyz version 1.1.4 installed or running are at risk of full compromise. Attackers may gain complete control over the affected system, leading to potential theft or misuse of secrets, keys, and other sensitive information. The compromise may persist even after package removal, increasing the risk of ongoing unauthorized access.

Remove the redis-xyz package version 1.1.4 immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted computer. Because full system compromise is possible and removal of the package may not eliminate all malicious components, consider rebuilding or thoroughly cleaning the affected system. No official patch or fix is currently available for this malicious package.