Malicious code in @modss/libsignal (npm)

The @modss/libsignal npm package has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host computer. The attacker may gain complete control, potentially accessing all stored secrets and keys. Due to the severity of the compromise, simply uninstalling the package is insufficient to ensure system integrity, as additional malicious software may have been installed.

Full system compromise on any computer with the package installed or running. All stored secrets and keys on the affected system are at risk and must be rotated from a secure environment. The attacker may maintain persistent access beyond the presence of the malicious package itself.

Immediately remove the @modss/libsignal package from affected systems. Rotate all secrets and keys from a different, uncompromised computer. Consider the affected system fully compromised and perform a thorough incident response, including system reimaging or replacement, to ensure removal of all malicious artifacts.