The npm package @postidigital-feature/oneaccount-orgadmin-front has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker to control the machine and access sensitive information such as stored secrets and keys. Due to the severity of the compromise, simply uninstalling the package may not remove all malicious components. This threat is cataloged under MAL-2026-6638 and GHSA-mfvg-7g48-p7c2. No CVSS score or patch information is available.

Any system with this package installed or running should be considered fully compromised. Attackers may have gained full control over the system, including access to all stored secrets and keys. This level of compromise can lead to unauthorized data access, credential theft, and further system exploitation. Removal of the package alone is insufficient to ensure system integrity.

Remove the @postidigital-feature/oneaccount-orgadmin-front package immediately. Rotate all secrets and keys stored on the affected system from a separate, trusted computer. Because the system may be fully compromised, consider rebuilding or replacing the affected machine to ensure complete removal of malicious software. No official patch or fix is available.