The eth-tick npm package versions 7.4.17 and 7.4.18 have been identified as containing malicious code. Installation or execution of these versions results in a full compromise of the host system, allowing an attacker to gain control. Due to the severity of the compromise, all credentials and secrets on the affected system should be rotated immediately from a different, secure machine. Simply uninstalling the package may not remove all malicious artifacts or backdoors introduced by the attacker.

Full system compromise on any computer running or having installed eth-tick versions 7.4.17 or 7.4.18. Potential exposure and theft of all stored secrets and keys. Persistent malicious presence may remain even after package removal, posing ongoing risk.

Remove the eth-tick package versions 7.4.17 and 7.4.18 immediately. Rotate all secrets and keys from a separate, uncompromised system. Conduct a thorough investigation and remediation of the affected system to identify and remove any persistent malicious software. No official patch or fix is available; the package should be considered unsafe and untrusted.