Malicious code in dim-svelte-ui (npm)

The npm package dim-svelte-ui version 1.0.0 has been identified as containing malicious code or depending on a malicious component. According to sources including Amazon Inspector and GHSA malware advisories, any system with this package installed or running should be considered fully compromised. The malicious code may allow an attacker to gain complete control over the affected computer, necessitating immediate secret and key rotation from a secure environment. Removal of the package is recommended but may not guarantee full remediation due to possible persistent compromise.

Systems with dim-svelte-ui version 1.0.0 installed are at risk of full compromise, including unauthorized control by an attacker. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a different, secure device. The presence of this package indicates a severe security breach with potential for extensive damage.

Remove the dim-svelte-ui package version 1.0.0 immediately. Rotate all secrets and keys from a separate, uncompromised device. Due to the likelihood of persistent compromise, consider full system reimaging or other comprehensive remediation steps beyond package removal. Monitor for any suspicious activity and consult security professionals for incident response.