The npm package [email protected] has been flagged as malicious by a security advisory (GHSA-5qfm-5r6q-m38q). Despite the absence of detected static or runtime malicious behaviors such as credential access, backdoors, or self-propagation in the scanned files, the package is considered a full compromise risk. The advisory warns that any system with this package installed should be treated as compromised, necessitating secret/key rotation from a different machine and removal of the package. There is no indication of an official patch or fix, and no known exploits in the wild have been reported.

Systems with [email protected] installed are considered fully compromised, implying potential unauthorized control or data exposure. All secrets and keys stored on such systems are at risk and must be rotated. Removing the package alone may not remove all malicious artifacts, indicating persistent compromise.

Immediate removal of the mobicwkgjmx package is recommended. All secrets and keys on the affected system should be rotated from a separate, uncompromised device. Due to the potential for persistent compromise, consider rebuilding or thoroughly cleaning the affected system. No official patch or fix is currently available; monitor vendor advisories for updates.