Malicious code in 3layerdipstackqcvl6h (npm)

The npm package '3layerdipstackqcvl6h' version 0.1.4 has been identified as containing malicious code or consuming dependencies that include malicious code. According to the source from Amazon Inspector and GHSA malware advisory, any system with this package installed or running should be considered fully compromised. The package grants attackers potential full control over the system, necessitating immediate secret and key rotation from a secure environment. Simply uninstalling the package does not guarantee removal of all malicious artifacts or backdoors introduced by the package.

Systems with the '3layerdipstackqcvl6h' package version 0.1.4 installed or running are fully compromised, allowing attackers to potentially control the system. All stored secrets and keys on the affected system are at risk and should be rotated immediately. The compromise may persist even after removal of the package due to possible additional malicious software installed.

Remove the '3layerdipstackqcvl6h' package version 0.1.4 immediately. Rotate all secrets and keys stored on the compromised system from a different, secure machine. Because the system may remain compromised even after package removal, consider rebuilding the system or performing a thorough forensic investigation to ensure complete eradication of malicious components.