The zredis-typed package in the npm ecosystem has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host computer. Due to the extent of the compromise, attackers may have persistent access beyond the presence of the package itself. Immediate secret and key rotation from a separate trusted system is advised. No patch or fix is available since this is a malicious package rather than a vulnerability in legitimate code.

Any system with the zredis-typed package installed or running should be considered fully compromised. Attackers may have gained full control over the system, potentially accessing or exfiltrating sensitive data, credentials, and secrets. The presence of this package poses a critical security risk, and trust in the affected system is lost until it is fully cleaned and secrets are rotated.

Remove the zredis-typed package immediately. Rotate all secrets and keys stored on the compromised system from a different, trusted computer. Because the attacker may have persistent access, consider rebuilding or fully reimaging the affected system to ensure complete removal of malicious components. No official patch or fix exists as this is a malicious package rather than a vulnerability in legitimate software.