Malicious code in clmm-fee-audit (npm)

The clmm-fee-audit npm package versions 0.1.0 and 0.1.1 were found to include malicious code or depend on a malicious component. According to sources including Amazon Inspector and GHSA malware advisories, any system with this package installed should be considered fully compromised. The malicious code presence implies that attackers may have gained full control over the affected system. Immediate secret rotation and removal of the package are recommended, but full remediation may require additional incident response due to potential persistence mechanisms.

Systems with clmm-fee-audit versions 0.1.0 or 0.1.1 installed are considered fully compromised. Attackers may have gained complete control over the system, risking exposure of all stored secrets and keys. The compromise may persist beyond removal of the package, necessitating comprehensive incident response and secret rotation.

Remove the clmm-fee-audit package versions 0.1.0 and 0.1.1 immediately. Rotate all secrets and keys stored on the affected system from a separate, secure computer. Conduct a thorough incident response to identify and eradicate any remaining malicious software or backdoors, as simply uninstalling the package may not fully remediate the compromise.