The @experian-shared/services npm package has been identified as containing malicious code. Installation or execution of this package results in full compromise of the host system, potentially allowing an attacker complete control. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors. This threat is classified as a malicious package rather than a traditional vulnerability with a patch or fix.

Full system compromise on any computer with the package installed or running. All secrets and keys stored on the affected system are at risk and should be considered compromised. There is no guarantee that removing the package will remove all malicious software introduced by it.

Remove the @experian-shared/services package immediately from all affected systems. Rotate all secrets, keys, and credentials stored on the compromised systems from a separate, trusted computer. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the affected hosts to ensure removal of all malicious components.