The ts-relayer-pub npm package version 1.0.0 is identified as containing malicious code that grants an attacker full control over the compromised system. This malicious package can lead to complete system compromise, including potential theft or misuse of stored secrets and keys. Due to the nature of the compromise, removal of the package alone does not guarantee eradication of all malicious artifacts or backdoors introduced. The advisory strongly recommends rotating all credentials from a different, uncompromised system to mitigate ongoing risk.

Any system with ts-relayer-pub version 1.0.0 installed or running should be considered fully compromised. Attackers may have gained complete control over the system, potentially accessing or exfiltrating sensitive information such as secrets and cryptographic keys. This poses a severe risk to confidentiality, integrity, and availability of the affected environment.

Remove the ts-relayer-pub package version 1.0.0 immediately. Rotate all secrets, keys, and credentials from a separate, secure system that has not been compromised. Because the system may be fully controlled by an attacker, consider rebuilding or replacing the affected system to ensure complete removal of malicious software. No official patch or fix is available; remediation relies on removal and credential rotation.