Malicious code in desmosclasswork (npm)

The 'desmosclasswork' npm package version 1.0.0 has been identified as containing malicious code or relying on a dependency that contains malicious code. According to sources including Amazon Inspector and GHSA malware reports, any system with this package installed should be considered fully compromised. The malicious code may grant an attacker full control over the affected system, compromising all stored secrets and keys. Removal of the package alone may not fully eliminate the threat due to potential persistence mechanisms.

Systems with 'desmosclasswork' version 1.0.0 installed are at risk of full compromise. Attackers may gain complete control over the system, leading to exposure and potential theft of all secrets and keys stored on the machine. This represents a critical security risk.

Remove the 'desmosclasswork' package version 1.0.0 immediately from all affected systems. Rotate all secrets and keys that were stored on the compromised machines from a secure, unaffected device. Due to the potential for persistent malicious software, consider a full system audit or rebuild to ensure complete remediation.