Malicious code in @beloved-lenora/opencode-shared-rpc (npm)

The npm package @beloved-lenora/opencode-shared-rpc has been identified as containing malicious code. Installation or execution of this package results in full compromise of the host system, potentially allowing attackers to gain control and access sensitive information such as secrets and keys. Because the attacker may maintain persistent access beyond the presence of the package itself, simply removing the package does not guarantee complete remediation.

Any system with this package installed or running should be considered fully compromised. Attackers may have gained full control over the system, including access to stored secrets and keys. This poses a severe risk of data breach, unauthorized access, and further malicious activity. Secrets and keys must be rotated immediately from a secure, unaffected environment to prevent misuse.

Remove the @beloved-lenora/opencode-shared-rpc package immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Due to the likelihood of persistent compromise, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious artifacts.