The npm package @ataslkit/profilecard version 99.9.1 has been identified as malicious by multiple sources including Amazon Inspector, GHSA malware reports, and the OpenSSF Package Analysis project. The package contains code that communicates with a domain associated with malicious activity, indicating potential backdoor or data exfiltration behavior. Systems with this package installed should be considered fully compromised, as the malicious code may have granted external entities control over the system. Due to the nature of the compromise, simply removing the package may not fully remediate the infection.

Any system with @ataslkit/profilecard version 99.9.1 installed or running is at risk of full compromise. Attackers may have gained control over the system, potentially accessing sensitive information, secrets, and keys. This can lead to unauthorized access, data theft, or further malicious activity originating from the compromised host.

Remove the @ataslkit/profilecard package version 99.9.1 immediately. Consider the affected system fully compromised and perform a thorough incident response. Rotate all secrets and keys stored on the compromised system from a separate, secure environment. There is no official patch or fix available; remediation requires removal and comprehensive recovery procedures.