Malicious code in borsh-lite (npm)

The 'borsh-lite' npm package version 1.0.0 includes malicious code or depends on a malicious package, leading to full system compromise upon installation. The malicious code presence was identified by Amazon Inspector and reported in the GHSA malware advisory. The advisory warns that systems with this package installed should be treated as fully compromised, requiring secret and key rotation and package removal. There is no CVSS score or patch available, and no known exploits in the wild have been reported.

Systems with 'borsh-lite' version 1.0.0 installed are considered fully compromised, potentially allowing attackers full control. All secrets and keys stored on the compromised system are at risk and must be rotated. Removing the package alone may not remove all malicious software introduced by the package.

Remove the 'borsh-lite' package version 1.0.0 immediately. Rotate all secrets and keys from a separate, trusted system. Due to the potential for persistent compromise, consider a full system investigation and remediation beyond package removal. No official patch or fix is available.