Malicious code in indexed-btree (npm)

The 'indexed-btree' npm package versions 2.1.1 and 2.1.2 have been identified as containing malicious code or consuming dependencies that include malicious code. According to sources including Amazon Inspector and GitHub Security Advisories, any system with these versions installed or running should be considered fully compromised. The malicious code may grant an attacker full control over the affected system, risking exposure of sensitive information such as secrets and keys. Due to the severity of the compromise, simply removing the package may not fully remediate the infection.

Systems with 'indexed-btree' versions 2.1.1 or 2.1.2 installed or running are at risk of full compromise. Attackers may gain complete control over the affected computer, leading to potential theft or misuse of stored secrets, keys, and other sensitive data. The presence of malicious code implies a high risk of persistent backdoors or other malicious activities beyond the package itself.

Remove the affected versions (2.1.1 and 2.1.2) of the 'indexed-btree' package immediately. Rotate all secrets and keys stored on the compromised system from a different, trusted machine. Because full control may have been granted to an attacker, additional forensic analysis and system remediation may be necessary. No official patch or fixed version is currently indicated; therefore, avoid using these versions altogether.