Malicious code in charclass (npm)

The 'charclass' npm package in specific versions (1.0.2, 1.0.3, 1.0.4, and 1.0.6) has been identified as containing malicious code or relying on a dependency that contains malicious code. This malicious code can lead to full compromise of any system where the package is installed or running. Due to the severity of the compromise, simply removing the package may not fully eradicate the malicious presence, as attackers may have established persistent control. The advisory recommends immediate secret and key rotation from a different, secure machine.

Systems with the affected 'charclass' package versions installed or running should be considered fully compromised. Attackers may have gained full control, risking exposure of all stored secrets and keys. The compromise is severe enough that removing the package alone does not guarantee removal of all malicious software or backdoors.

Remove the affected 'charclass' package versions immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure computer. Due to the potential for persistent compromise, consider rebuilding or thoroughly cleaning the affected system. No official patch or fix is indicated; the best mitigation is removal and secret rotation.