Malicious code in 3layerdipstackev4sn5 (npm)

The npm package '3layerdipstackev4sn5' version 0.1.4 was identified by Amazon Inspector and GHSA as containing malicious code or relying on a dependency that contains malicious code. This malicious package can fully compromise any computer on which it is installed or executed. The compromise includes potential unauthorized access and control, necessitating immediate secret and key rotation from a separate trusted environment. Due to the risk of persistent malware beyond the package itself, simply uninstalling the package does not guarantee full remediation.

Any system with the '3layerdipstackev4sn5' package version 0.1.4 installed or running should be considered fully compromised. Attackers may have gained complete control over the system, risking exposure and theft of sensitive data including stored secrets and keys. The presence of this malicious package undermines system integrity and confidentiality.

Remove the '3layerdipstackev4sn5' package version 0.1.4 immediately from all affected systems. Rotate all secrets and keys that were stored on compromised machines from a separate, secure computer. Because full control may have been given to attackers, consider comprehensive incident response measures beyond package removal. Patch status is not applicable as this is a malicious package, not a vulnerability with a vendor fix.