Malicious code in elf-stats-cranberry-wishlist-933 (npm)

The npm package 'elf-stats-cranberry-wishlist-933' in versions 1.0.1, 1.0.2, and 2.0.0 includes malicious code that, when installed or executed, fully compromises the host system. The compromise implies that attackers may have gained full control over the affected computer, including access to sensitive credentials and keys. Due to the severity of the compromise, simply uninstalling the package is insufficient to ensure system integrity, as residual malicious software may persist.

Any system with the affected versions of this package installed or running should be considered fully compromised. Attackers may have obtained full control over the system, including access to all secrets and keys stored on it. This poses a critical risk of data breach, unauthorized access, and potential further exploitation. The persistence of malicious software beyond package removal increases the difficulty of full remediation.

Remove the 'elf-stats-cranberry-wishlist-933' package immediately from all affected systems. Rotate all secrets and keys stored on compromised systems using a different, secure computer. Due to the likelihood of persistent malicious software, consider rebuilding or thoroughly cleaning affected systems to ensure complete eradication of the compromise.