Malicious code in @fongsidev/scraper (npm)

The @fongsidev/scraper npm package has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker to gain complete control. Due to the severity of the compromise, secrets and keys stored on the machine are at risk and must be rotated from a secure environment. The package removal does not assure complete remediation because the attacker may have deployed additional malicious software or backdoors.

Full system compromise on any computer running or having installed the @fongsidev/scraper package. All stored secrets and keys on the compromised machine are at risk of exposure and misuse. The attacker may maintain persistent access beyond the presence of the malicious package itself.

Immediately remove the @fongsidev/scraper package from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised machines from a separate, secure device. Conduct a thorough investigation and remediation to identify and remove any additional malicious software or backdoors that may have been installed. Do not rely solely on package removal for full remediation.