The pino-utils package versions 1.3.6 and 1.4.0 distributed via npm contain malicious code that, when installed or executed, fully compromises the host computer. This malicious package allows an attacker to gain complete control over the system, potentially exfiltrating secrets and keys. Due to the severity of the compromise, remediation involves not only removing the package but also rotating all credentials from a different, uncompromised system. There is no indication of a patch or fixed version available, and no known exploits in the wild have been reported yet.

Any system with pino-utils versions 1.3.6 or 1.4.0 installed or running is considered fully compromised. Attackers may have gained full control over the system, including access to sensitive secrets and keys. This level of compromise poses a critical risk to confidentiality, integrity, and availability of the affected system and any connected infrastructure.

Remove the affected pino-utils package versions 1.3.6 and 1.4.0 immediately. Rotate all secrets and keys from a separate, secure computer to prevent further unauthorized access. Because the system is likely fully compromised, consider rebuilding the affected systems from a trusted backup or clean source. No official patch or fixed version is currently available; monitor vendor advisories for updates.