Malicious code in @beloved-lenora/opencode-goal (npm)

The npm package @beloved-lenora/opencode-goal has been identified as containing malicious code. Installation or execution of this package results in full compromise of the affected computer, potentially allowing an attacker to gain complete control. Due to the severity of the compromise, all secrets and keys stored on the affected system should be rotated immediately from a secure, unaffected device. Simply uninstalling the package may not remove all malicious artifacts or backdoors introduced by the attacker.

Full system compromise on any computer with the package installed or running. Potential exposure and theft of all stored secrets and keys. Persistent malicious presence may remain even after package removal.

Remove the @beloved-lenora/opencode-goal package immediately. Rotate all secrets and keys from a different, uncompromised computer. Conduct a thorough investigation and remediation of the affected system, as removing the package alone may not eliminate all malicious software.