The @report-portal/service-ui npm package has been identified as containing malicious code that, when installed or executed, results in a full compromise of the host computer. This includes potential exposure and theft of all stored secrets and keys. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious components or backdoors introduced by the attacker. Immediate rotation of all secrets and keys from a separate, uncompromised system is strongly advised.

Full system compromise on any computer with the malicious package installed or running. All secrets and keys stored on the system are at risk of exposure and misuse. Persistent malicious presence may remain even after package removal.

Remove the @report-portal/service-ui package immediately from affected systems. Rotate all secrets and keys stored on the compromised computer using a different, trusted system. Because the attacker may have established persistent control, consider rebuilding the affected systems from known good backups or reinstalling the operating system to ensure complete remediation. Patch status is not applicable as this is a malicious package, not a vulnerability with a vendor fix.