Malicious code in cloudfcrxz (npm)

The 'cloudfcrxz' package in the npm ecosystem contains malicious code or depends on malicious components. According to sources including Amazon Inspector and GitHub Security Advisories, any system with this package installed should be considered fully compromised. The malicious code can lead to unauthorized control over the system, risking exposure of sensitive information such as secrets and keys. Complete remediation requires rotating all credentials from a secure environment and removing the package, although residual malicious software may persist.

Full system compromise is indicated, with potential unauthorized access to all secrets and keys stored on the affected computer. The presence of malicious code means attackers may have persistent control, making the system untrustworthy even after package removal.

Remove the 'cloudfcrxz' package immediately. Rotate all secrets and keys from a different, uncompromised computer. Because full control may have been given to an attacker, consider rebuilding or thoroughly cleaning the affected system to ensure complete removal of malicious software.