The @jacobtan/decode-sdk npm package is identified as malicious software that, when installed or executed, fully compromises the host computer. This compromise includes potential unauthorized access and control by an outside entity. Due to the severity of the compromise, all credentials and secrets stored on the affected system must be rotated from a separate, secure machine. The package removal is necessary but insufficient to ensure complete remediation, as the attacker may have installed additional persistent malicious components.

Full compromise of any computer with the package installed or running. Potential exposure and theft of secrets and keys stored on the system. The attacker may have persistent control beyond the presence of the package itself.

Immediately remove the @jacobtan/decode-sdk package from all affected systems. Rotate all secrets, keys, and credentials that were stored on the compromised machines, performing this rotation from a separate, trusted device. Conduct a thorough investigation and remediation of the affected systems, as removing the package alone does not guarantee elimination of all malicious components.