The @ddh-libs/analytics package distributed via npm has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker to gain complete control. Due to the severity of the compromise, all stored secrets and keys on the affected system must be rotated from a different, secure machine. The package removal does not ensure complete remediation, as additional malicious artifacts may persist on the system.

Full system compromise on any computer with the package installed or running. Potential exposure and theft of all stored secrets and keys. Persistence of malicious software beyond the presence of the package itself, leading to ongoing security risks.

Immediately remove the @ddh-libs/analytics package from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, secure computer. Conduct a thorough investigation and remediation of the affected systems, as removal of the package alone does not guarantee elimination of all malicious software. No official patch or fix is available; mitigation relies on removal and secret rotation.