The 'auth-state-service' npm package, when required, attempts to load 'ssr-auth-sync'. If this dependency is missing, it silently executes 'npm install ssr-auth-sync' without warnings or saving it to package files, then requires it. The 'ssr-auth-sync' package is unpinned and unverified, allowing arbitrary code execution within the consumer's process. The primary package uses obfuscation and a misleading package identity unrelated to its actual functionality, indicating a supply-chain attack. This behavior effectively compromises any system using the package, as the malicious payload is dynamically fetched and executed.

Any computer with 'auth-state-service' installed or running is considered fully compromised. The malicious package can execute arbitrary code within the process, potentially leading to complete system compromise. All secrets and keys stored on the affected system are at risk and should be rotated immediately. Removal of the package alone does not guarantee eradication of the malicious software, as the attacker may have established persistent control.

There is no official patch or fix available for this malicious package. The recommended mitigation is to immediately remove 'auth-state-service' from all systems. Additionally, all secrets and keys stored on affected systems must be rotated from a separate, trusted environment. Due to the severity and nature of the compromise, affected systems should be considered fully compromised and may require comprehensive incident response and remediation.