Malicious code in @cortana-md/engine (npm)

The @cortana-md/engine package in the npm ecosystem contains malicious code or relies on a dependency with malicious code. This compromises any computer where the package is installed or executed, potentially allowing attackers full control. The advisory strongly recommends immediate rotation of all secrets and keys from a separate, uncompromised system. Due to the nature of the compromise, simply uninstalling the package may not fully remediate the infection.

Systems with the @cortana-md/engine package installed are considered fully compromised, risking exposure of all stored secrets and keys. Attackers may have gained persistent control, making data theft and further malicious activity highly likely.

Remove the @cortana-md/engine package immediately. Rotate all secrets and keys from a separate, secure machine to prevent unauthorized access. Because full system compromise is likely, consider rebuilding affected systems from trusted backups or clean installations. No official patch or fix is available; remediation relies on removal and secret rotation.