The peptideenv package on npm, specifically versions 16.6.1 to 16.6.6, has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the affected system. The malicious code potentially grants attackers complete control, making it critical to assume all stored secrets and keys on the compromised system are exposed. Due to the possibility of persistent backdoors or additional malware, simply uninstalling the package does not guarantee remediation.

Systems with peptideenv versions 16.6.1 to 16.6.6 installed or running are fully compromised. Attackers may have gained complete control over the system, exposing all stored secrets and keys. This level of compromise can lead to unauthorized access, data theft, and further malicious activities. The threat is severe enough that secrets must be rotated from a different, uncompromised system to prevent ongoing unauthorized access.

Remove the peptideenv package versions 16.6.1 to 16.6.6 immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure computer. Because full system compromise is likely, consider rebuilding or fully restoring the affected system from a known good backup. No official patch or fix is available; remediation relies on removal and secret rotation.