Malicious code in foldmap (npm)

The 'foldmap' npm package version 2.0.3 has been identified as containing malicious code or relying on a malicious dependency. According to sources including Amazon Inspector and GitHub Security Advisories, any system with this package installed should be considered fully compromised. The malicious code may grant an attacker full control over the affected system, compromising all stored secrets and keys. Due to the severity of the compromise, simply uninstalling the package may not remove all malicious components.

Systems with 'foldmap' version 2.0.3 installed are at risk of full compromise. Attackers may gain complete control over the system and access to all stored secrets and keys. This can lead to unauthorized data access, credential theft, and further malicious activity. The compromise is severe enough that removal of the package alone is insufficient to ensure system integrity.

Remove the 'foldmap' package version 2.0.3 immediately from all affected systems. Rotate all secrets, keys, and credentials from a different, secure computer to prevent further unauthorized access. Due to the potential for persistent malicious software beyond the package itself, consider a full system audit and remediation. No official patch or fix is available; mitigation relies on removal and credential rotation.