Malicious code in club-sauce (npm)

The 'club-sauce' npm package version 9.9.11 is identified as containing malicious code that can fully compromise an affected system. According to the source advisory (GHSA-vm8j-8r82-992m), any computer with this package installed or running should be considered fully compromised. The malicious code potentially grants an outside entity full control over the system, risking exposure of all stored secrets and keys. Due to the severity of the compromise, simply removing the package may not remove all malicious artifacts. The advisory recommends immediate rotation of all secrets and keys from a different, secure computer to mitigate ongoing risk.

Full system compromise on any computer with the affected package installed or running. Exposure and potential theft of all secrets and keys stored on the compromised system. Persistent malicious presence may remain even after package removal, indicating a high risk of ongoing unauthorized access.

Remove the 'club-sauce' package version 9.9.11 immediately from all affected systems. Rotate all secrets and keys stored on the compromised machines from a separate, secure computer to prevent unauthorized access. Because full system compromise is possible, consider rebuilding or thoroughly cleaning affected systems to ensure removal of all malicious software. Monitor for any signs of continued compromise.