Malicious code in btree-leaderboard (npm)

The 'btree-leaderboard' npm package version 2.3.1 has been identified as containing malicious code or consuming a dependency with malicious code. According to the source data from Amazon Inspector and GitHub Security Advisories, any system with this package installed or running should be considered fully compromised. The advisory emphasizes the need for immediate rotation of all secrets and keys from a different, uncompromised system. Due to the potential for persistent malicious control, simply removing the package does not guarantee complete remediation.

Systems with 'btree-leaderboard' version 2.3.1 installed or running are considered fully compromised. Attackers may have gained full control, risking exposure of all stored secrets and keys. This can lead to unauthorized access, data theft, and further malicious activities on the compromised system.

Remove the 'btree-leaderboard' package version 2.3.1 immediately. Rotate all secrets and keys from a secure, uncompromised system. Because full control may have been given to attackers, additional system integrity checks and remediation steps should be performed beyond package removal. No official patch or fix is indicated; therefore, avoidance of this package version is recommended.