The middleware-jwt package version 1.0.0 was found to contain malicious code or to consume a dependency that contains malicious code. This malicious code can lead to full compromise of any computer where the package is installed or running. The advisory warns that all secrets and keys on the compromised system should be rotated from a separate, secure system. Due to the nature of the compromise, removing the package alone may not fully remediate the infection.

Systems with middleware-jwt version 1.0.0 installed or running are considered fully compromised. Attackers may have gained full control over the system, potentially exposing all stored secrets and keys. The compromise may persist even after removal of the package, indicating a high risk of persistent malicious presence.

Remove the middleware-jwt package version 1.0.0 immediately from affected systems. Rotate all secrets and keys that were stored on the compromised system, performing this rotation from a different, trusted computer. Because full system compromise is possible, consider rebuilding or thoroughly cleaning the affected system. There is no official patch or fix available; remediation relies on removal and secret rotation.