Malicious code in heft-storybook-v6-react-tutorial-storykit (npm)

The npm package 'heft-storybook-v6-react-tutorial-storykit' in versions 1000.0.16 and 1000.0.13 has been identified as containing malicious code that compromises any computer on which it is installed or executed. The compromise is severe enough that all stored secrets and keys on the system are considered at risk and require immediate rotation from a separate, uncompromised system. Due to the nature of the compromise, simply uninstalling the package does not guarantee removal of all malicious artifacts or backdoors.

Full system compromise on any computer with the affected package installed or running. Potential exposure and theft of secrets and keys stored on the system. Persistent malicious presence may remain even after package removal.

Immediately remove the affected package versions 1000.0.16 and 1000.0.13 from all systems. Rotate all secrets and keys stored on compromised systems from a different, secure computer. Conduct a thorough investigation and remediation of the compromised systems as removal of the package alone may not eliminate all malicious software.