Malicious code in mkb-manager (npm)

The mkb-manager package on npm has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker to access all stored secrets and keys. Due to the extent of the compromise, simply removing the package may not remove all malicious components or backdoors introduced. Immediate rotation of all secrets and keys from a separate, trusted system is advised.

Complete compromise of the affected computer, including exposure of all stored secrets and keys. The attacker may have persistent access beyond the presence of the malicious package itself.

Remove the mkb-manager package immediately. Rotate all secrets and keys from a different, uncompromised computer. Because full control of the system may have been given to an attacker, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious software.