The fetchcraft npm package declares a runtime dependency on 'node-runtime-utils' fetched directly from the main branch of a personal GitHub repository via a tarball URL without commit SHA, tag, or integrity hash pinning. This mutable dependency can be altered at any time, enabling an attacker to execute arbitrary code during the npm install lifecycle scripts. The dependency is not used by fetchcraft's exported code, indicating no legitimate functional purpose and suggesting malicious intent. Systems with fetchcraft installed should be considered fully compromised.

Any system with fetchcraft versions 1.0.0 or 1.0.1 installed is at risk of full compromise due to arbitrary code execution during package installation. Attackers may gain complete control over the affected system, potentially accessing and exfiltrating all stored secrets and keys. Because the malicious code executes during installation, the system's integrity and confidentiality are severely impacted. Removing the package does not guarantee removal of all malicious artifacts or backdoors.

Immediate removal of the fetchcraft package versions 1.0.0 and 1.0.1 is recommended. All secrets and keys stored on the compromised system should be rotated from a separate, trusted machine. Due to the high risk of full system compromise, a full system forensic analysis and potential rebuild may be necessary. Patch status is not confirmed; no official fix or updated safe version is indicated. Users should avoid installing fetchcraft until a trusted, verified version is released.