The @anna-money/anna-web-lib package distributed via npm has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, allowing an attacker to gain control. Due to the severity of the compromise, simply uninstalling the package may not remove all malicious artifacts. The advisory recommends immediate rotation of all secrets and keys from a different, secure system to mitigate potential credential theft or misuse.

Any system with this package installed or running is considered fully compromised, potentially exposing all stored secrets and keys. The attacker may have persistent control beyond the presence of the package itself, posing a severe risk to confidentiality, integrity, and availability of the affected system and its data.

Remove the @anna-money/anna-web-lib package immediately. Rotate all secrets and keys stored on the affected system using a separate, uncompromised computer. Because the system may be fully compromised, consider rebuilding or replacing the affected machine to ensure complete removal of malicious software.