Malicious code in @alipclutch/libsignal-node (npm)

The @alipclutch/libsignal-node npm package has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host computer, potentially allowing an attacker complete control. Due to the severity of the compromise, all sensitive credentials and keys stored on the affected system must be rotated from a different, secure machine. Simply uninstalling the package is insufficient to ensure system integrity, as the attacker may have installed additional persistent malicious components.

Any system with the @alipclutch/libsignal-node package installed or running is considered fully compromised. Attackers may have gained full control over the system, risking exposure or theft of all stored secrets and keys. This can lead to unauthorized access, data breaches, and further malicious activity originating from the compromised host.

Immediately remove the @alipclutch/libsignal-node package from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised systems from a separate, secure device. Conduct a thorough investigation and remediation of the affected systems, as removal of the package alone does not guarantee elimination of all malicious software. Consider rebuilding or restoring systems from known good backups to ensure full eradication of the compromise.