The [email protected] npm package is a malicious package that deceptively claims to have zero dependencies but actually depends on base58-core. While typescript-base58 itself does not contain lifecycle scripts, network calls, or obfuscation, the security risk arises from the base58-core package it pulls in. According to the GHSA advisory, any system with this package installed is considered fully compromised, requiring immediate secret rotation and package removal. The package's malicious nature is confirmed by the GHSA and GCVE sources, though no detailed analysis of base58-core is provided in this record.

Systems with [email protected] installed are considered fully compromised. Attackers may have gained full control over the affected computer, potentially accessing all secrets and keys stored on it. Immediate secret and key rotation from a different, uncompromised system is necessary. Removing the package alone may not eliminate all malicious software introduced by the compromise.

Remove the [email protected] package immediately from all affected systems. Rotate all secrets and keys stored on the compromised systems using a secure, unaffected environment. Because full system compromise is possible, further forensic analysis and remediation may be required. No official patch or fix is available; mitigation relies on removal and secret rotation.