The npm package [email protected] ships with multiple heavily obfuscated JavaScript bundles under the assets/ directory, including AccountPage, DarkVeil, GamesPage, PlusBlockedNote, and SettingsPage. The obfuscation uses javascript-obfuscator-style hex identifiers (_0x-prefixed variable names). The package's name suggests a backup utility, but the included code bundles are UI-related and suspicious. There is no available traced code path to confirm or exclude malicious behaviors such as credential harvesting, exfiltration, or remote code execution. According to the ghsa-malware source, any computer with this package installed should be considered fully compromised, necessitating immediate secret and key rotation and package removal.

Systems with the [email protected] package installed are considered fully compromised. The presence of heavily obfuscated code raises the risk of hidden malicious activities, including potential credential theft, data exfiltration, or remote code execution. The compromise may extend beyond the package itself, as attackers could have established persistent control over the affected system. Therefore, all secrets and keys stored on the compromised system must be rotated immediately from a separate, secure device.

Remove the [email protected] package immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised systems from a different, secure computer. Because the system may be fully compromised, consider rebuilding the affected systems from a trusted backup or reinstalling the operating system to ensure complete removal of any malicious artifacts. No official patch or fix is available for this malicious package.