Malicious code in @lucideproxy/svg (npm)

The @lucideproxy/svg package on npm has been identified as containing malicious code. Installation or execution of this package results in a full system compromise, allowing attackers to potentially access all stored secrets and keys. Due to the severity of the compromise, remediation requires not only removal of the package but also immediate rotation of all credentials from a different, secure environment. There is no guarantee that removal of the package alone will eradicate all malicious artifacts or backdoors introduced by the attacker.

Complete compromise of any computer with the package installed or running. Attackers may have full control over the system and access to all stored secrets and keys. This poses a critical risk to confidentiality, integrity, and availability of the affected system and any connected resources.

Remove the @lucideproxy/svg package immediately. Rotate all secrets and keys stored on the affected system from a separate, uncompromised computer. Because the attacker may have persistent control, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components.