Malicious code in finvu-hdfc-sdk (npm)

The finvu-hdfc-sdk npm package version 99.9.9 has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker to gain complete control. Due to the severity of the compromise, all sensitive credentials stored on the affected system should be rotated immediately from a secure environment. Removal of the package alone is insufficient to ensure system integrity, as additional malicious components may persist.

Any system with finvu-hdfc-sdk version 99.9.9 installed is considered fully compromised. Attackers may have gained complete control over the system, risking exposure and theft of all stored secrets and keys. This can lead to further unauthorized access and potential lateral movement within the affected environment.

Remove the finvu-hdfc-sdk package version 99.9.9 immediately. Rotate all secrets and keys that were stored on the compromised system from a different, trusted machine. Because the system is fully compromised, consider rebuilding or restoring the system from a known good backup to ensure complete removal of malicious software.