The @tbe-ui/ides package in the npm ecosystem is identified as containing malicious code that results in a full system compromise upon installation or execution. This compromise allows attackers to gain complete control over the affected computer, potentially exposing all stored secrets and keys. Due to the depth of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors introduced. The advisory recommends treating any system with this package as fully compromised and taking immediate remediation steps including secret rotation from a secure environment.

Any system with the @tbe-ui/ides package installed or running is considered fully compromised, risking exposure of all stored secrets and keys. Attackers may have persistent control beyond the presence of the package itself, making the system untrustworthy until fully remediated.

Remove the @tbe-ui/ides package immediately. Treat the affected system as fully compromised and rotate all secrets and keys from a different, uncompromised computer. Because full control may have been given to an attacker, additional forensic analysis and remediation may be necessary. No official patch or fix is available; the best mitigation is removal and secret rotation.