The fastnodemailer package on npm, specifically versions 8.0.2, 8.0.3, and 8.0.4, contains embedded malicious code that compromises any computer on which it is installed or executed. This compromise potentially grants full control to an attacker, necessitating immediate secret and key rotation from a secure environment. The malicious code presence means that simply uninstalling the package may not fully remediate the infection, as additional malware may persist on the system.

Systems with the affected fastnodemailer package installed are fully compromised, risking exposure of all stored secrets and keys. Attackers may have gained full control over the affected computers, leading to potential data theft, unauthorized access, and persistent malicious activity.

Remove the fastnodemailer package versions 8.0.2, 8.0.3, and 8.0.4 from all affected systems. Immediately rotate all secrets and keys from a separate, uncompromised computer. Because the system may remain compromised even after package removal, consider a full system audit and remediation to ensure all malicious software is eradicated.