The express-dotenv package version 1.3.5 is identified as containing malicious code that results in a full system compromise upon installation or execution. The malicious package grants attackers full control over the affected computer, posing a severe security risk. Because the attacker may have established persistent access or installed additional malware, simply uninstalling the package does not guarantee remediation. The advisory strongly recommends rotating all secrets and keys from a different, uncompromised system to prevent further unauthorized access.

Any system with express-dotenv version 1.3.5 installed or running is fully compromised, meaning attackers can execute arbitrary code, access sensitive data, and maintain persistent control. This includes exposure of all stored secrets and keys, which must be considered compromised and rotated immediately. The integrity and confidentiality of the affected system cannot be assured.

Remove the express-dotenv package version 1.3.5 immediately from all affected systems. Rotate all secrets, keys, and credentials stored on the compromised systems using a separate, secure computer. Because the system is fully compromised, consider rebuilding or restoring the system from a known good backup to ensure complete removal of malicious components. No official patch or fix is available; remediation relies on removal and credential rotation.