The @ms-ows/logging package distributed via npm has been identified as containing malicious code. Installation or execution of this package leads to a full compromise of the host system. Due to the nature of the compromise, attackers may have gained persistent control, making remediation beyond package removal necessary. There is no CVSS score assigned, and no patch or fix is available. The vendor has not provided an official advisory or remediation guidance. This is a supply chain attack vector via a malicious npm package.

Any system with the @ms-ows/logging package installed or running should be considered fully compromised. Attackers may have access to all stored secrets and keys on the system. The integrity and confidentiality of the affected system are severely impacted. Removal of the package alone is insufficient to restore system trustworthiness.

Remove the @ms-ows/logging package immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted computer. Conduct a thorough investigation and remediation of the affected system, as full control may have been given to an attacker. No official patch or fix is available; remediation relies on removal and secret rotation.