Malicious code in gclassroom (npm)

The 'gclassroom' package in the npm ecosystem has been identified as containing malicious code or relying on dependencies that include malicious code. According to sources including Amazon Inspector and GHSA malware reports, any system with this package installed or running should be considered fully compromised. The malicious code may allow attackers to gain full control over the system, potentially exposing sensitive information such as secrets and keys. Due to the nature of the compromise, simply uninstalling the package does not guarantee removal of all malicious artifacts or backdoors.

Full system compromise is indicated for any computer with the 'gclassroom' package installed or running. This includes potential unauthorized access to all stored secrets and keys, which must be rotated immediately from a secure environment. The presence of malicious code implies a high risk of data theft, system manipulation, and persistent attacker control.

Immediate removal of the 'gclassroom' package is recommended. However, because the system may be fully compromised, all secrets and keys stored on the affected machine should be rotated from a different, trusted computer. Additional forensic analysis and system restoration may be necessary to ensure complete removal of malicious software. No official patch or fix is available; remediation relies on removal and secret rotation.