Malicious code in @lekzo_dev/amprem (npm)

The @lekzo_dev/amprem npm package is identified as malicious software that, when installed or executed, results in a full system compromise. This includes potential unauthorized access and control by an external attacker. The advisory warns that simply uninstalling the package may not suffice to remove all malicious artifacts, and that all sensitive credentials on the affected system should be rotated from a secure environment.

Any system with this package installed or running is considered fully compromised, with potential unauthorized access to all secrets and keys stored on the system. This represents a total loss of system integrity and confidentiality.

Remove the @lekzo_dev/amprem package immediately from any affected systems. Rotate all secrets and keys stored on the compromised system from a different, secure machine. Due to the potential for persistent malicious software beyond the package itself, consider a full system reinstallation or forensic analysis to ensure complete remediation.