The confluent-kafka-javascript package distributed via npm has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the affected system, potentially allowing an attacker complete control. Due to the severity of the compromise, all secrets and keys stored on the system must be rotated immediately from a different, uncompromised device. Removal of the package alone is insufficient to ensure system integrity, as additional malicious software may persist.

Any system with this package installed or running should be considered fully compromised. Attackers may have gained complete control over the system, risking exposure and theft of all stored secrets and keys. This can lead to further unauthorized access, data breaches, and persistent malicious presence.

Remove the confluent-kafka-javascript package immediately. Rotate all secrets and keys from a separate, secure computer to prevent further unauthorized access. Because the system is likely fully compromised, consider rebuilding or restoring the system from a known good backup to ensure removal of all malicious components.