Malicious code in desmoshomework (npm)

The 'desmoshomework' npm package version 1.0.0 was identified by Amazon Inspector and GitHub Security Advisories as containing malicious code or relying on a malicious dependency. This compromises any system where the package is installed or executed, potentially granting attackers full control over the system. The advisory warns that simply removing the package may not fully eliminate the threat due to possible persistence mechanisms. All secrets and keys on the compromised system should be rotated immediately from a secure environment.

Systems with 'desmoshomework' version 1.0.0 installed are considered fully compromised. Attackers may have gained complete control over the system, risking exposure and theft of all stored secrets and keys. The presence of malicious code implies potential unauthorized access, data exfiltration, and persistent backdoors.

Remove the 'desmoshomework' package version 1.0.0 immediately from all affected systems. Rotate all secrets, keys, and credentials from a separate, secure computer to prevent further compromise. Because the system may be fully controlled by an attacker, consider rebuilding or restoring the system from a known good backup to ensure complete remediation.