The @mcconnect/mcc-common-lib npm package has been identified as malicious. Installation or execution of this package results in a full compromise of the affected system. Attackers may gain complete control, potentially exfiltrating secrets and keys stored on the machine. Due to the severity of the compromise, remediation involves not only removing the package but also rotating all credentials from a trusted environment, as the system may remain compromised even after removal.

Full system compromise on any computer with the package installed or running. All stored secrets and keys on the affected system are at risk and should be considered compromised. The attacker may have persistent access beyond the presence of the package itself.

Remove the @mcconnect/mcc-common-lib package immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Because full control of the system may have been given to an attacker, consider the system untrusted and perform a full forensic analysis and remediation beyond just removing the package.