Malicious code in @global-theme/context (npm)

The npm package @global-theme/context at version 99.9.1 has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker complete control. Due to the severity of the compromise, all sensitive credentials stored on the system should be rotated immediately from a different, secure machine. Removal of the package is necessary but insufficient to ensure complete remediation, as the attacker may have installed additional persistent malicious components.

Any system with the malicious @global-theme/context package installed or running is considered fully compromised. Attackers may have gained full control over the system, risking exposure and theft of all stored secrets and keys. This compromises the confidentiality, integrity, and availability of the affected system and any connected resources relying on its security.

Remove the @global-theme/context package version 99.9.1 immediately from affected systems. Rotate all secrets, keys, and credentials stored on the compromised system from a separate, secure device. Because removal of the package may not eliminate all malicious software, consider rebuilding or thoroughly cleaning the affected system to ensure complete remediation.