The @cxp-shared/string-utilities npm package is identified as containing malicious code that fully compromises the host system. Installation or execution of this package results in a complete system compromise, potentially allowing attackers to access sensitive information such as secrets and keys. Due to the nature of the compromise, simply uninstalling the package is insufficient to ensure system integrity, as additional malicious software may have been installed. Immediate secret/key rotation from a separate secure environment is strongly advised.

Any system with this package installed or running is considered fully compromised. Attackers may have gained full control over the system, putting all stored secrets and keys at risk. The compromise may extend beyond the package itself, as other malicious software could have been deployed. This poses a critical risk to confidentiality, integrity, and availability of the affected system and its data.

Remove the @cxp-shared/string-utilities package immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Because the system may be fully compromised, consider rebuilding or restoring the system from a known good backup to ensure removal of all malicious components. Monitor for any suspicious activity and apply standard incident response procedures.