Malicious code in desmoswork (npm)

The 'desmoswork' npm package version 1.0.0 has been identified as containing malicious code or relying on a malicious dependency. According to sources including Amazon Inspector and GHSA malware advisories, any system with this package installed should be considered fully compromised. The malicious code can lead to complete control over the affected system by an external attacker. Removal of the package alone may not fully eradicate the threat due to potential persistence mechanisms. Immediate secret and key rotation from a secure environment is recommended.

Systems with 'desmoswork' version 1.0.0 installed are at risk of full compromise, including unauthorized access to all stored secrets and keys. The malicious code may allow attackers to maintain persistent control over the system, rendering removal of the package insufficient to guarantee remediation.

Remove the 'desmoswork' package version 1.0.0 immediately from all affected systems. Rotate all secrets and keys stored on the compromised systems from a separate, secure machine. Due to the risk of persistent compromise, consider a full system rebuild or forensic analysis to ensure complete eradication of malicious code.