Malicious code in 3layerdipstackpsq4vf (npm)

The npm package '3layerdipstackpsq4vf' version 0.1.4 has been identified as containing malicious code or relying on a dependency with malicious code. According to sources including Amazon Inspector and GHSA malware advisories, any system with this package installed or running should be considered fully compromised. The malicious code may allow an attacker to gain full control over the affected system, necessitating immediate secret and key rotation from a secure environment. Removal of the package does not guarantee complete remediation as the attacker may have installed additional persistent malware.

Full system compromise is indicated for any computer with the affected package installed or running. This includes potential unauthorized access to all stored secrets and keys, which must be rotated immediately. The malicious code may enable persistent control by an attacker beyond the presence of the package itself.

Remove the '3layerdipstackpsq4vf' package version 0.1.4 immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Due to the likelihood of persistent compromise, consider rebuilding the affected system from a known good backup or fresh installation to ensure complete remediation.