Malicious code in eyiouss (npm)

The 'eyiouss' npm package in versions 3.0.21, 3.0.22, and 4.0.1 has been identified as containing malicious code or depending on a malicious package. This results in full compromise of any computer where the package is installed or running. The malicious code may grant an external entity control over the system, risking exposure of all stored secrets and keys. Due to the potential persistence of malicious software beyond the package itself, simply removing the package may not fully remediate the compromise.

Any system with the affected versions of the 'eyiouss' package installed or running should be considered fully compromised. All secrets and keys stored on the system are at risk and must be rotated immediately from a different, secure computer. The compromise may allow an attacker full control over the system, and removal of the package alone is insufficient to guarantee eradication of malicious software.

Remove the affected versions of the 'eyiouss' package (3.0.21, 3.0.22, 4.0.1) from all systems. Immediately rotate all secrets and keys stored on compromised systems using a separate, trusted computer. Due to the likelihood of persistent malicious software, consider full system reimaging or forensic analysis to ensure complete remediation.