Malicious code in ethe (npm)

The 'ethe' npm package version 99.15.0 is identified as containing malicious code that compromises the host system entirely. Installation or execution of this package grants an attacker full control over the affected computer, risking exposure of all stored secrets and keys. Due to the nature of the compromise, simply uninstalling the package does not guarantee removal of all malicious artifacts. The advisory recommends immediate rotation of all secrets and keys from a separate, secure system and removal of the package to mitigate ongoing risk.

Full system compromise on any computer with the 'ethe' package version 99.15.0 installed or running. All secrets and keys stored on the compromised system are at risk and should be considered exposed. The attacker may maintain persistent access beyond the presence of the package itself.

Remove the 'ethe' package version 99.15.0 immediately from all affected systems. Rotate all secrets and keys from a different, uncompromised computer to prevent unauthorized access. Because full system compromise is possible, additional forensic analysis and remediation may be necessary. No official patch or fix is available; the package should be considered malicious and avoided.