Malicious code in @beloved-lenora/opencode-btw (npm)

The '@beloved-lenora/opencode-btw' package on npm has been identified as containing malicious code. Installation or execution of this package results in full compromise of the host system, potentially exposing all stored secrets and keys. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious components or backdoors introduced by the attacker.

Systems with this package installed or running should be considered fully compromised. All secrets and keys stored on these systems are at risk and should be rotated immediately from a secure, unaffected environment. There is no assurance that removing the package will eliminate all malicious software or attacker presence.

Remove the '@beloved-lenora/opencode-btw' package immediately. Rotate all secrets and keys from a different, uncompromised computer. Conduct a thorough security assessment of the affected systems to identify and remove any persistent malicious components. Consider rebuilding or restoring systems from known good backups to ensure complete remediation.