The @multformats/multiaddr package distributed via npm has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system. The malicious code likely provides attackers with extensive control, potentially allowing exfiltration or manipulation of sensitive data. Due to the nature of the compromise, simply uninstalling the package is insufficient to remediate the threat, as persistent malicious artifacts may remain on the system.

Any system with this package installed or running should be considered fully compromised. Attackers may have gained full control over the system, putting all stored secrets and keys at risk. This necessitates immediate rotation of all credentials from a secure environment. The integrity and confidentiality of the affected system cannot be assured until a full remediation and credential rotation is performed.

Remove the @multformats/multiaddr package immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure computer. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components. No official patch or fix is available; remediation relies on removal and credential rotation.