Malicious code in @grua/icons (npm)

The npm package @grua/icons version 99.0.0 has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the affected computer. Due to the severity of the compromise, all sensitive credentials and keys stored on the system must be rotated from a separate, secure environment. The package removal is necessary but insufficient to fully remediate the infection, as the attacker may have installed additional persistent malicious components.

Any system with @grua/icons version 99.0.0 installed or running is considered fully compromised. Attackers may have gained full control over the system, potentially accessing or exfiltrating sensitive data, credentials, and keys. This level of compromise poses a critical risk to confidentiality, integrity, and availability of the affected system and any connected resources.

Immediate removal of the @grua/icons package version 99.0.0 is required. All secrets, keys, and credentials stored on the compromised system must be rotated immediately using a different, trusted computer. Due to the possibility of persistent malicious software beyond the package itself, a full system rebuild or forensic analysis is recommended to ensure complete remediation.