Malicious code in eslint-prettier-js (npm)

The eslint-prettier-js package distributed via npm includes malicious code that, when installed or executed, can result in a full system compromise. The attacker may gain complete control over the affected computer, potentially accessing and exfiltrating sensitive information such as secrets and keys. Due to the severity of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors introduced by the attacker.

Full compromise of the affected computer, including potential unauthorized access to all stored secrets and keys. The attacker may maintain persistent control beyond the presence of the malicious package itself, posing a significant risk to confidentiality and system integrity.

Immediately remove the eslint-prettier-js package from all affected systems. Rotate all secrets and keys stored on compromised computers from a separate, trusted device. Because full control may have been granted to an attacker, consider rebuilding or thoroughly cleaning affected systems to ensure removal of all malicious components.