Malicious code in elf-stats-caroling-stocking-510 (npm)

The npm package elf-stats-caroling-stocking-510 in versions 1.0.0, 1.0.1, 1.0.2, 1.0.3, and 1.0.4 contains embedded malicious code that can fully compromise any computer on which it is installed or running. This compromise may allow an attacker to gain persistent control over the system. The package is identified as malicious by the GHSA advisory GHSA-ggp7-664r-m55m and is cataloged under MAL-2026-14078 in the OSV database. Due to the nature of the compromise, simply removing the package does not guarantee removal of all malicious artifacts or backdoors.

Systems with this package installed are considered fully compromised, meaning attackers may have full control over the affected computer. Any secrets, credentials, or keys stored on the system are at risk of exposure and should be rotated immediately from a secure environment. The presence of this package can lead to persistent unauthorized access and potential data loss or further system manipulation.

Immediate removal of the elf-stats-caroling-stocking-510 package is recommended. However, because the system may be fully compromised, it is critical to rotate all secrets and keys from a different, trusted computer. Additional incident response actions may be necessary to ensure complete eradication of malicious components. No official patch or fix is available; remediation relies on removal and comprehensive recovery procedures.