Malicious code in manager-thedate (npm)

The 'manager-thedate' package in the npm ecosystem is identified as containing malicious code that grants full control of the affected computer to an outside entity. This level of compromise implies that attackers may have installed additional malicious software beyond the package itself. The advisory strongly recommends immediate secret and key rotation from a separate machine and removal of the package, though removal may not fully restore system integrity.

Any system with the 'manager-thedate' package installed or running should be considered fully compromised. Attackers may have gained complete control, potentially accessing or exfiltrating sensitive information such as secrets and keys. The presence of this package poses a critical security risk to the confidentiality, integrity, and availability of the affected system.

Remove the 'manager-thedate' package immediately. Rotate all secrets and keys stored on the affected computer from a different, uncompromised machine. Due to the potential for persistent malicious software beyond the package itself, consider full system remediation or reimaging to ensure complete removal of the compromise.