Malicious code in @a23842/dsh-notifier (npm)

The npm package @a23842/dsh-notifier, specifically versions 0.1.0, 0.1.2, 0.2.0, 0.2.1, 0.2.2, 0.2.3, and 0.3.0, was found to contain malicious code or to consume dependencies that contain malicious code. This malicious code can lead to complete system compromise. The advisory indicates that any computer with this package installed should be treated as fully compromised, requiring immediate secret and key rotation from a separate, uncompromised system. Removal of the package does not guarantee full remediation due to potential persistence of malicious software.

Systems with the affected versions of @a23842/dsh-notifier installed are at risk of full compromise. Attackers may gain complete control over the system, potentially exposing all stored secrets and keys. The compromise is severe enough that simply uninstalling the package may not remove all malicious components.

Users should immediately remove the @a23842/dsh-notifier package from their systems. All secrets and keys stored on compromised systems must be rotated from a different, secure computer. Because full control may have been given to attackers, additional system remediation or rebuilding may be necessary. No official patch or fix is indicated; the best mitigation is removal and secret rotation.