@doaction/example is a scoped npm package with versions 9.9.9 and 99.99.99 identified as malicious. Its package.json includes a preinstall script that calls code from a shared dependency (@doaction/shared) whose actual behavior is not included in the tarball and remains unverified. The package's versioning and namespace suggest a possible dependency confusion attack targeting internal namespaces. According to the source ghsa-malware, any system with this package installed should be considered fully compromised, and all secrets must be rotated. The package should be removed, but full remediation is uncertain due to potential persistent malicious code.

Systems with this package installed or running are considered fully compromised. Attackers may have gained full control, risking exposure of all stored secrets and keys. Immediate secret rotation from a secure environment is required. Removal of the package does not guarantee elimination of all malicious artifacts.

No official patch or fix is available. Immediate removal of the @doaction/example package versions 9.9.9 and 99.99.99 is recommended. All secrets and keys on affected systems should be rotated immediately from a secure, uncompromised environment. Due to potential persistent compromise, consider full system remediation or rebuild. Review and audit internal package namespaces to prevent dependency confusion attacks.