Malicious code in @fazzcodestudio/fbot (npm)

The @fazzcodestudio/fbot npm package is identified as malicious software that, when installed or executed, results in full compromise of the host computer. This includes potential unauthorized access and control by an external entity. The advisory warns that simply uninstalling the package may not remove all malicious components, implying persistence mechanisms or additional payloads may be present. The recommendation is to consider the system fully compromised and to rotate all secrets and keys from a secure environment.

Full compromise of the affected computer, including unauthorized access to all stored secrets and keys. Potential persistent malicious presence beyond the package itself. High risk of data theft, credential exposure, and system control by attackers.

Remove the @fazzcodestudio/fbot package immediately. Consider the affected system fully compromised and perform a thorough incident response, including rotating all secrets and keys from a separate, secure computer. Do not rely solely on package removal to restore system integrity.