Malicious code in 3layerdipstackvcdkrp (npm)

The npm package '3layerdipstackvcdkrp' version 0.1.4 has been identified as containing malicious code or relying on a dependency with malicious code. According to sources including Amazon Inspector and GHSA malware advisories, any system with this package installed or running should be considered fully compromised. The package grants potential full control to an attacker, risking exposure of all stored secrets and keys. Removal of the package alone may not fully remediate the infection due to possible persistence mechanisms. This package is flagged under MAL-2026-14958 and GHSA-5cqp-h6j9-xhff.

Systems with the '3layerdipstackvcdkrp' package version 0.1.4 installed or running are at risk of full compromise. Attackers may gain complete control over the affected system, leading to potential theft or misuse of sensitive information such as secrets and keys. The compromise may persist beyond package removal, indicating a severe security impact.

Remove the '3layerdipstackvcdkrp' package version 0.1.4 immediately from all affected systems. Rotate all secrets, keys, and credentials from a separate, uncompromised machine to prevent unauthorized access. Due to the potential for persistent malicious software beyond the package itself, conduct a thorough system investigation and remediation. No official patch or fix is available; the best mitigation is removal and credential rotation.