Malicious code in 3layerdipstack2pdlo4 (npm)

The npm package '3layerdipstack2pdlo4' version 0.1.4 has been identified as containing malicious code or consuming dependencies that include malicious code. According to sources including Amazon Inspector and GitHub Security Advisories, any system with this package installed or running should be considered fully compromised. The package allows an attacker to gain full control over the affected computer, potentially exposing all stored secrets and keys. Due to the nature of the compromise, simply uninstalling the package does not guarantee removal of all malicious components or backdoors.

Systems with the '3layerdipstack2pdlo4' package version 0.1.4 installed or running are fully compromised, meaning attackers may have complete control over the system. All secrets and keys stored on the system are at risk and should be considered exposed. The compromise may persist beyond removal of the package, indicating a high impact on confidentiality, integrity, and availability of the affected systems.

Remove the '3layerdipstack2pdlo4' package version 0.1.4 immediately from all affected systems. Rotate all secrets and keys that were stored on the compromised systems, performing this action from a separate, trusted machine. Because full control may have been given to an attacker, consider rebuilding or thoroughly cleaning affected systems to ensure complete removal of malicious software. No official patch or fix is available; remediation relies on removal and secret rotation.