Malicious code in @aircanada/navigation-handler (npm)

The @aircanada/navigation-handler package on npm has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker to gain complete control. Due to the severity of the compromise, secrets and keys stored on the affected system must be rotated from a different, secure machine. Simply uninstalling the package is insufficient to ensure the system is clean, as additional malicious components may have been installed.

Any system with the @aircanada/navigation-handler package installed or running should be considered fully compromised. Attackers may have gained complete control over the system, risking exposure or theft of sensitive information including secrets and keys. The compromise may persist even after removal of the package due to potential additional malware installed.

Remove the @aircanada/navigation-handler package immediately. Rotate all secrets and keys stored on the compromised system using a separate, trusted device. Conduct a thorough investigation and remediation of the affected system, as removal of the package alone does not guarantee elimination of all malicious software. Consider rebuilding or restoring the system from a known good backup.