Malicious code in @beloved-lenora/opencode-orchestrator (npm)

The @beloved-lenora/opencode-orchestrator npm package is identified as containing malicious code that compromises the host system completely. According to the source details, any system with this package installed or running should be considered fully compromised. The malicious package potentially grants full control to an outside entity. Even after removal of the package, residual malicious software may persist, necessitating immediate secret and key rotation from a separate, uncompromised system.

Full system compromise on any computer with the package installed or running. All secrets and keys stored on the compromised system are at risk and should be rotated immediately. Removal of the package alone does not ensure complete remediation due to possible persistence of malicious software.

Remove the @beloved-lenora/opencode-orchestrator package immediately. Rotate all secrets and keys stored on the affected system from a different, trusted computer. Consider the affected system fully compromised and perform a thorough security assessment and remediation beyond just package removal.