The feedback-ai-sdk package distributed via npm has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing attackers to access all stored secrets and keys. Due to the extent of the compromise, remediation requires rotating all credentials from a separate, secure environment and removing the package. However, because the attacker may have established persistent control, removing the package alone may not fully restore system integrity.

Any system with the feedback-ai-sdk package installed or running should be considered fully compromised. Attackers may have gained full control over the system, exposing all stored secrets and keys. This level of compromise poses a critical risk to confidentiality, integrity, and availability of the affected system and any connected resources.

Remove the feedback-ai-sdk package immediately. Rotate all secrets and keys stored on the affected system from a different, uncompromised machine. Because the attacker may have persistent access, consider rebuilding or fully restoring the affected system from a known good backup to ensure complete remediation.