Malicious code in h3-codex (npm)

The 'h3-codex' package in the npm ecosystem contains malicious code or depends on a component that does. Installation or execution of this package can lead to full compromise of the affected system. The advisory emphasizes that any computer with this package should be treated as fully compromised, requiring secret and key rotation from a secure environment. Removal of the package is advised but may not guarantee complete remediation due to possible persistent malicious presence.

Systems with the 'h3-codex' package installed or running are considered fully compromised, risking exposure of all stored secrets and keys. Attackers may have gained full control over the affected computer, leading to potential data theft, unauthorized access, and persistent malicious activity.

Remove the 'h3-codex' package immediately. Rotate all secrets and keys stored on the compromised computer from a different, secure machine. Because full system compromise is likely, additional forensic analysis and remediation steps may be necessary beyond package removal. No official patch or fix is available; mitigation relies on removal and secret rotation.