Malicious code in btree-time-index (npm)

The 'btree-time-index' npm package version 1.2.1 has been identified as containing malicious code or relying on a dependency that contains malicious code. According to sources including Amazon Inspector and the GitHub Security Advisory for malware, any system with this package installed or running should be considered fully compromised. The malicious code can lead to unauthorized control over the system, necessitating immediate secret and key rotation from a secure environment. Complete removal of the package may not fully remediate the compromise due to potential persistence of malicious artifacts.

Systems with 'btree-time-index' version 1.2.1 installed or running are at risk of full compromise. This includes potential unauthorized access and control by an attacker. All secrets and keys stored on the compromised system are considered exposed and must be rotated. The presence of this package indicates a severe security breach with potential long-term persistence of malicious software.

Remove the 'btree-time-index' package version 1.2.1 immediately. Rotate all secrets and keys from a different, uncompromised system. Because full control of the system may have been granted to an attacker, consider rebuilding or thoroughly cleaning the affected system to ensure complete removal of malicious software. Monitor for any suspicious activity and avoid reinstalling the compromised package.