Malicious code in google-cloud-internal-core-utils (npm)

The 'google-cloud-internal-core-utils' npm package is identified as containing malicious code that results in a full compromise of the host system. The malicious package can lead to unauthorized access and control over the affected computer, including exposure of stored secrets and keys. The advisory strongly recommends removing the package and rotating all secrets and keys from a different, secure computer. There is no indication of a patch or fix for this package, and no CVSS score is assigned. The threat is documented under OSV ID MAL-2026-15840 and GHSA alias GHSA-4vvq-8686-f44c.

Any system with this package installed or running should be considered fully compromised. Attackers may have gained full control over the system, including access to all stored secrets and keys. This level of compromise can lead to severe data breaches and further unauthorized actions within the affected environment.

Remove the 'google-cloud-internal-core-utils' package immediately from all affected systems. Rotate all secrets and keys stored on the compromised systems using a separate, secure computer. Due to the potential for persistent malicious control, consider a full system reinstallation or forensic analysis to ensure complete removal of malicious components. No official patch or fix is available for this malicious package.