Malicious code in @mikudeveloper/libsignal-node (npm)

The @mikudeveloper/libsignal-node package on npm has been identified as containing malicious code. Installation or execution of this package can lead to a full compromise of the host computer, potentially allowing an attacker to control the system and access sensitive information such as secrets and keys. The advisory warns that simply removing the package may not fully eliminate the threat due to possible persistent malicious components installed alongside it.

Any system with this package installed or running should be considered fully compromised. Attackers may have gained full control over the system, including access to all stored secrets and keys. This level of compromise poses a severe risk to confidentiality, integrity, and availability of the affected system and any connected resources.

Remove the @mikudeveloper/libsignal-node package immediately. Rotate all secrets and keys from a different, trusted computer to prevent further unauthorized access. Due to the possibility of persistent malicious software, consider performing a full system investigation and remediation beyond just removing the package.