The js-unimode package distributed via npm in versions 1.1.1 to 1.1.10 includes malicious code that compromises the host system. Installation or execution of this package grants an attacker full control over the affected computer. Due to the severity of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors. This threat is identified as MAL-2026-6840 and has no CVSS score assigned. There are no known exploits in the wild reported at this time.

Systems with the affected versions of js-unimode installed are considered fully compromised, potentially allowing attackers complete control over the system. All secrets and keys stored on such systems are at risk and must be rotated immediately from a secure, unaffected environment. The presence of the malicious package may have introduced persistent malware beyond the package itself.

Remove the js-unimode package versions 1.1.1 through 1.1.10 from all affected systems. Immediately rotate all secrets and keys stored on compromised systems from a different, secure computer. Because full system compromise is likely, consider rebuilding affected systems from trusted backups or reinstalling the operating system to ensure removal of all malicious components. There is no official patch or fix available; remediation relies on removal and secret rotation.