Malicious code in grandfather_of_the_desert (npm)

The 'grandfather_of_the_desert' package in the npm ecosystem has been identified as containing malicious code or relying on a malicious dependency. This compromises any computer where the package is installed or executed, potentially granting full control to an attacker. Due to the severity of the compromise, simply uninstalling the package does not guarantee removal of all malicious artifacts or backdoors.

Systems with the 'grandfather_of_the_desert' package installed or running are fully compromised. Attackers may have gained complete control, risking exposure of all stored secrets and keys. Immediate secret/key rotation from a different, uncompromised system is necessary. Removal of the package does not ensure full remediation due to potential persistence mechanisms.

Remove the 'grandfather_of_the_desert' package immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure computer. Because full control may have been given to an attacker, consider rebuilding or thoroughly cleaning the affected system to ensure complete removal of malicious software.