Malicious code in dsh-waste-market (npm)

The 'dsh-waste-market' npm package version 0.6.1 has been identified as containing malicious code or relying on a dependency that contains malicious code. According to sources including Amazon Inspector and GHSA malware advisories, any system with this package installed or running should be considered fully compromised. The malicious code may grant an attacker full control over the system, necessitating immediate rotation of all secrets and keys from a separate, uncompromised device. Simply uninstalling the package does not guarantee removal of all malicious artifacts.

Systems with 'dsh-waste-market' version 0.6.1 installed or running are at risk of full compromise. Attackers may gain complete control over the affected computer, leading to potential theft or misuse of sensitive information such as secrets and keys. The compromise may persist even after package removal due to residual malicious software.

Remove the 'dsh-waste-market' package version 0.6.1 immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Because full system compromise is possible, consider a full system reinstallation or forensic analysis to ensure all malicious components are eradicated.