The winston-js-express package, specifically versions 1.0.0, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.1.1, and 1.1.2, contains embedded malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker full control. Due to the nature of the compromise, simply removing the package may not remove all malicious artifacts or backdoors. The threat is identified as a malicious package within the npm ecosystem and is tracked under MAL-2026-6904 and GHSA-fhrx-mrfp-3fvg.

Systems with any of the affected versions of winston-js-express installed are considered fully compromised. Attackers may have gained full control over the system, risking exposure or theft of all stored secrets and keys. The presence of malicious code implies potential persistent backdoors or additional malware beyond the package itself.

Remove the winston-js-express package immediately from all affected systems. Rotate all secrets, keys, and credentials stored or used on the compromised systems from a separate, trusted environment. Because full system compromise is likely, consider rebuilding or thoroughly auditing affected systems to ensure removal of all malicious components. No official patch or fix is currently available; remediation relies on removal and secret rotation.