Malicious code in google-logging-utils-internal (npm)

The google-logging-utils-internal npm package versions 1.1.3, 1.1.4, and 9.9.9 contain malicious code that, when installed or executed, results in a full system compromise. This compromise grants an attacker complete control over the affected computer, including access to all stored secrets and keys. Due to the depth of the compromise, simply removing the package may not eradicate all malicious components introduced. The advisory recommends immediate secret and key rotation from a separate secure system and removal of the malicious package.

Systems with the affected versions of google-logging-utils-internal installed or running are considered fully compromised. Attackers may have obtained full control over the system and access to all stored secrets and keys. This poses a critical risk to confidentiality, integrity, and availability of the affected system and any connected infrastructure relying on compromised credentials.

Remove the google-logging-utils-internal package immediately from affected systems. Rotate all secrets and keys stored on the compromised computer using a different, secure machine. Because full system compromise is possible, further forensic analysis and remediation may be necessary. No official patch or fix is indicated; the package itself is malicious.