The nuxt-fonts-devtools package distributed via npm has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host computer. Due to the severity of the compromise, all credentials and secrets stored on the affected machine must be considered exposed and rotated immediately from a separate, secure environment. Removal of the package alone is insufficient to ensure system integrity, as the attacker may have deployed additional persistent malware or backdoors.

Full system compromise on any computer with the package installed or running. Exposure of all stored secrets and keys on the affected system. Potential persistent malicious presence beyond the package itself, leading to ongoing unauthorized access and control.

Remove the nuxt-fonts-devtools package immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised machines, performing this rotation from a separate, trusted computer. Conduct a thorough investigation and remediation of the affected systems to identify and remove any additional malicious software or backdoors that may have been installed. There is no official patch or fix for this malicious package; mitigation relies on removal and credential rotation.