The eslint-plugin-totara package at version 99.9.1 was identified as malicious by multiple sources including Amazon Inspector, GHSA malware reports, and the OpenSSF Package Analysis project. The package contains code that communicates with a domain associated with malicious activity, indicating it is designed to perform unauthorized or harmful actions. Systems with this package installed or running should be considered fully compromised, as the malicious code may have granted external control. The package is flagged as a supply chain threat in the npm ecosystem.

Systems with eslint-plugin-totara version 99.9.1 installed or running are at risk of full compromise. Attackers may have gained unauthorized access or control, potentially exposing all stored secrets and keys. The presence of malicious communication domains suggests data exfiltration or command and control activities. Simply removing the package does not guarantee eradication of all malicious artifacts.

Remove the eslint-plugin-totara package version 99.9.1 immediately from all affected systems. Consider all systems with this package installed as fully compromised. Rotate all secrets, keys, and credentials from a separate, uncompromised device. Conduct a thorough investigation and remediation of affected systems to ensure no residual malicious software remains. Monitor for any suspicious activity related to this compromise. Patch status is not applicable as this is a malicious package, not a vulnerability with a vendor fix.