The 'ioredis-orm' npm package (version 5.11.2) is a malicious clone of the legitimate 'ioredis' Redis client, designed to confuse users by mimicking the original package's structure and metadata. Although the package itself does not contain install hooks or direct malicious code, it silently pulls in a transitive dependency 'ioredis-typed', which is not part of the legitimate upstream project and is undocumented. This transitive dependency is suspected to carry malicious payloads, posing a supply-chain risk. The presence of this package on a system implies a full compromise, necessitating immediate secret/key rotation and removal of the package.

Any system with 'ioredis-orm' version 5.11.2 installed should be considered fully compromised. The malicious transitive dependency may have given attackers control over the system, risking exposure of secrets, credentials, and keys. Removal of the package alone does not guarantee elimination of all malicious artifacts or backdoors introduced. Immediate secret and key rotation from a secure environment is required to mitigate potential damage.

Remove the 'ioredis-orm' package from all affected systems. Immediately rotate all secrets, keys, and credentials stored or used on compromised systems from a different, secure environment. Because the package pulls a malicious transitive dependency, manual inspection and removal of any additional malicious components is advised. There is no official patch or fix for this malicious package; prevention relies on avoiding installation and removing it if present.