The feedback-ai-sdk package distributed via npm is identified as malicious software. Installation or execution of this package results in full compromise of the host system, potentially allowing an attacker complete control. The advisory warns that all secrets and keys stored on the compromised machine should be rotated immediately from a different, uncompromised system. Removal of the package alone is insufficient to ensure system integrity, as additional malicious components may persist.

Any system with the feedback-ai-sdk package installed or running is considered fully compromised, risking exposure of all stored secrets and keys. Attackers may have persistent access and control, making the system untrustworthy. There is no guarantee that removing the package will eliminate all malicious artifacts.

Remove the feedback-ai-sdk package immediately. Rotate all secrets and keys from a separate, secure machine that has not been compromised. Conduct a thorough investigation and consider rebuilding the affected system to ensure complete removal of malicious software. No official patch or fix is available; remediation relies on removal and secret rotation.