The browserslist-db-sync npm package versions 1.0.4 and 1.0.6 include a suspicious use of Buffer.from(..., "base64").toString("utf8") in lib/mirror.js line 13, a pattern that can be used to obfuscate malicious payloads or credentials. Although the exact intent of the decoded data is not fully determined, the package is flagged as malicious by the GHSA-malware source, indicating that any system with this package installed should be considered fully compromised. Immediate remediation involves removing the package and rotating all secrets and keys from a separate, uncompromised system.

Systems with the affected versions of browserslist-db-sync installed or running are considered fully compromised. Attackers may have gained full control over the system, potentially exposing all stored secrets and keys. This level of compromise necessitates urgent security response actions to prevent further damage or data loss.

Remove the browserslist-db-sync package versions 1.0.4 and 1.0.6 immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Due to the potential for full system compromise, additional forensic analysis and remediation may be required beyond package removal.