Malicious code in @beloved-lenora/opencode-todo (npm)

The npm package @beloved-lenora/opencode-todo has been identified as containing malicious code that grants full control of the infected computer to an outside entity. This level of compromise means that any sensitive information such as secrets and keys stored on the machine is at risk and must be rotated promptly. The package removal is necessary but insufficient to fully remediate the infection due to potential persistence mechanisms installed alongside the malicious package.

Systems with this package installed or running are considered fully compromised, risking exposure of all stored secrets and keys. The attacker may have persistent control over the system, making it unsafe to trust the machine until fully cleaned or rebuilt. Sensitive credentials and keys must be rotated from a secure environment to prevent further unauthorized access.

Immediate removal of the @beloved-lenora/opencode-todo package is required. All secrets and keys stored on the compromised system must be rotated immediately from a different, trusted computer. Due to the potential persistence of malicious software beyond the package itself, a full system audit, cleaning, or rebuild is recommended to ensure complete remediation.