Malicious code in @beloved-lenora/opencode-stats (npm)

The @beloved-lenora/opencode-stats npm package is identified as containing malicious code capable of fully compromising the host computer. According to the source details, installation or execution of this package grants an attacker full control over the system, potentially exposing all stored secrets and keys. Due to the depth of compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors introduced. The advisory strongly recommends rotating all secrets and keys from a different, secure machine to mitigate ongoing risk.

Full system compromise on any computer with the package installed or running. Exposure and potential theft of all secrets and keys stored on the system. Persistent malicious presence may remain even after package removal.

Remove the @beloved-lenora/opencode-stats package immediately. Rotate all secrets and keys from a separate, uncompromised device to prevent unauthorized access. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the affected machine to ensure removal of all malicious software.