Malicious code in create-json-client (npm)

The 'create-json-client' npm package version 1.0.0 has been identified as containing malicious code or relying on a dependency that contains malicious code. According to sources including Amazon Inspector and GitHub Security Advisories, any system with this package installed or running should be considered fully compromised. The malicious code may grant an attacker full control over the affected system, risking exposure of all stored secrets and keys. Removal of the package alone may not fully eliminate the threat due to potential persistence mechanisms.

Systems with 'create-json-client' version 1.0.0 installed or running are at risk of full compromise. Attackers may gain complete control over the affected computer, leading to potential theft or misuse of secrets, keys, and sensitive data. The compromise may persist even after package removal, necessitating comprehensive incident response.

Remove the 'create-json-client' package version 1.0.0 immediately from all affected systems. Rotate all secrets, keys, and credentials from a separate, uncompromised system. Conduct a thorough security assessment of affected machines to identify and remediate any persistent malicious components. There is no official patch or fix available; therefore, avoidance and removal are the primary mitigations.