Malicious code in classroomwork (npm)

The 'classroomwork' npm package version 1.0.0 was identified by Amazon Inspector and GitHub Security Advisory as containing malicious code or a dependency with malicious code. This malicious package can compromise any computer on which it is installed or executed, potentially granting attackers full control. The advisory strongly recommends immediate rotation of all secrets and keys from a separate, uncompromised system. Due to the severity of the compromise, simply uninstalling the package may not fully remove the malicious presence.

Systems with 'classroomwork' version 1.0.0 installed or running are considered fully compromised. Attackers may have gained full control over the affected machines, risking exposure of all stored secrets and keys. The integrity and confidentiality of the system and data are severely impacted.

Remove the 'classroomwork' package version 1.0.0 immediately. Rotate all secrets and keys from a different, secure computer to prevent unauthorized access. Because the system may be fully compromised, consider a full system rebuild or forensic analysis to ensure complete removal of malicious software. No official patch or fix is available; the package should be avoided entirely.