The npm package [email protected] is flagged as malicious by a malware advisory despite no static or behavioral indicators of typical supply-chain attack patterns. The package name is a random alphabetic string, which is unusual for legitimate libraries. Amazon Inspector analysis found no install-time scripts, network callbacks, credential access, or code execution primitives. However, the GHSA malware advisory states that any computer with this package installed should be considered fully compromised, recommending immediate secret and key rotation and package removal, though removal may not fully clean the system.

Systems with the [email protected] package installed are considered fully compromised. Attackers may have gained full control, risking exposure of all stored secrets and keys. Simply removing the package does not guarantee removal of all malicious components introduced by the package.

Remove the [email protected] package immediately. Rotate all secrets and keys stored on the affected system from a separate, trusted computer. Because full system compromise is possible, consider a full system rebuild or forensic analysis to ensure complete remediation. Patch status is not applicable as this is a malicious package rather than a vulnerability with a fix.