Malicious code in 3layerdipstackkrgcjq (npm)

The npm package '3layerdipstackkrgcjq' version 0.1.4 has been identified as containing malicious code or consuming a dependency that contains malicious code. According to sources including Amazon Inspector and the GitHub Security Advisory for malware (GHSA-vc65-p3ww-752q), any system with this package installed or running should be considered fully compromised. The malicious code may grant an attacker full control over the system, necessitating immediate secret and key rotation from a separate, uncompromised device. Removal of the package does not guarantee eradication of all malicious artifacts or backdoors introduced by the package.

Systems with the '3layerdipstackkrgcjq' package version 0.1.4 installed or running are at risk of full compromise. Attackers may gain complete control over the affected computer, potentially accessing or exfiltrating sensitive information such as secrets and keys. The presence of this package undermines system integrity and confidentiality.

Immediate removal of the '3layerdipstackkrgcjq' package version 0.1.4 is recommended. However, because the system may be fully compromised, all secrets and keys stored on the affected machine should be rotated from a different, trusted computer. Additional forensic analysis and remediation may be necessary to ensure complete eradication of malicious code and persistence mechanisms.