The '@ai-agent-node/createnode' npm package has been identified as containing malicious code that fully compromises any computer where it is installed or executed. This compromise extends to all secrets and keys stored on the system, necessitating immediate rotation from a different, uncompromised device. Due to the potential for persistent malicious software beyond the package itself, simply uninstalling the package does not ensure full remediation. There is no CVSS score available for this threat. No known exploits in the wild have been reported. The package is not a cloud service, so remediation depends on local actions.

Full system compromise on any computer with the package installed or running. All stored secrets and keys on the affected system are at risk and should be considered compromised. The attacker may have persistent access beyond the presence of the package itself.

Remove the '@ai-agent-node/createnode' package immediately from all affected systems. Rotate all secrets and keys stored on the compromised machines using a separate, trusted device. Because the system may be fully compromised, consider rebuilding the affected systems from a known good state to ensure complete removal of malicious software.