Malicious code in game_overlay (npm)

The 'game_overlay' npm package version 8.5.8 has been identified as containing malicious code that can lead to a full system compromise. Installation or execution of this package may grant an attacker complete control over the affected computer. The compromise is severe enough that removal of the package alone might not suffice to clean the system. The advisory recommends immediate removal of the package and rotation of all secrets and keys from a separate, uncompromised machine to mitigate the impact.

Any computer with the 'game_overlay' package version 8.5.8 installed or running should be considered fully compromised. This implies that attackers may have gained full control over the system, potentially accessing or exfiltrating sensitive information, including stored secrets and keys. The compromise is severe and may persist even after the package is removed.

Remove the 'game_overlay' package version 8.5.8 immediately from all affected systems. Rotate all secrets and keys stored on the compromised computer using a different, secure device. Due to the potential for persistent compromise, consider a full system rebuild or forensic analysis to ensure complete removal of malicious components.