This threat involves the @finantix/webcomponents package distributed via npm, which contains malicious code. Installation or execution of this package results in a full compromise of the host system. The attacker may gain complete control, potentially leading to theft or misuse of secrets and credentials stored on the machine. Due to the nature of the compromise, simply uninstalling the package is insufficient to ensure system integrity, and comprehensive remediation steps including secret rotation and system reimaging are recommended.

Any system with this package installed or running is considered fully compromised, risking exposure of all stored secrets and keys. The attacker may have persistent control beyond the presence of the package itself, making the system untrustworthy until fully cleaned or rebuilt.

Remove the @finantix/webcomponents package immediately. Rotate all secrets and keys that were stored on the compromised system using a separate, secure device. Because the attacker may have established persistent control, consider full system reimaging or replacement to ensure complete eradication of malicious code. Monitor for any suspicious activity related to the compromised system.