Malicious code in classlesson (npm)

The 'classlesson' npm package version 1.0.0 has been identified as containing malicious code or relying on a malicious dependency. According to Amazon Inspector and GitHub Security Advisory sources, any system with this package installed should be considered fully compromised. The malicious code may grant attackers full control over the system, risking exposure of sensitive credentials and secrets. Removal of the package alone may not fully remediate the compromise due to potential persistence mechanisms.

Full system compromise is likely if the package is installed or running. All secrets and keys stored on the affected computer are at risk and should be rotated immediately from a secure environment. The presence of this package undermines system integrity and confidentiality.

Remove the 'classlesson' package version 1.0.0 immediately from all affected systems. Rotate all secrets and keys from a separate, uncompromised machine. Due to the potential for persistent malicious activity, consider a full system investigation and remediation beyond just package removal.