Malicious code in frank-apple-sync-service (npm)

The 'frank-apple-sync-service' npm package is identified as malicious. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker complete control. Due to the severity of the compromise, sensitive credentials and keys on the affected system are considered exposed and must be rotated from a secure environment. The malicious package may install additional persistent malware, so simply uninstalling it does not ensure full remediation.

Any system with this package installed or running is fully compromised. Attackers may have gained complete control over the system, exposing all stored secrets and keys. This can lead to unauthorized access, data theft, and further malicious activity. The compromise is severe and persistent beyond the presence of the package itself.

Remove the 'frank-apple-sync-service' package immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Because the system may remain compromised even after removal, consider rebuilding or thoroughly cleaning the affected system to ensure complete eradication of malicious software.