The solana-address-codec package versions 1.0.0 and 1.0.1 have been identified as containing malicious code or relying on a dependency that contains malicious code. According to the source data from Amazon Inspector and GHSA malware advisories, any system with these package versions installed should be considered fully compromised. The malicious code may allow an attacker to gain full control over the affected system, necessitating immediate secret and key rotation from a clean environment. No official patch or fix is currently available for these versions.

Systems with solana-address-codec versions 1.0.0 or 1.0.1 installed are at risk of full compromise. Attackers may gain complete control over the system, potentially accessing all stored secrets and keys. This level of compromise can lead to unauthorized data access, credential theft, and further malicious activity. Simply removing the package may not fully eradicate the threat due to possible persistence mechanisms installed by the malicious code.

Remove the solana-address-codec package versions 1.0.0 and 1.0.1 immediately from all affected systems. Rotate all secrets and keys stored on compromised systems using a separate, trusted environment. Because full system compromise is possible, consider rebuilding or thoroughly cleaning affected systems. No official patch or fix is currently available; monitor vendor advisories for updates.