Malicious code in mw-filesystem-events-nodream-es6 (npm)

The npm package mw-filesystem-events-nodream-es6 version 0.0.32 is identified as containing malicious code that compromises the host system completely. Installation or execution of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected computer. Due to the severity of the compromise, removal of the package alone is insufficient to ensure system integrity, as attackers may have deployed persistent malicious software. The advisory recommends immediate secret/key rotation from a secure environment and removal of the malicious package.

Full system compromise on any computer with the affected package installed or running. All secrets and keys stored on the compromised system are at risk and should be considered exposed. The attacker may maintain persistent access beyond the presence of the package itself.

Remove the mw-filesystem-events-nodream-es6 package version 0.0.32 immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure machine. Because full control of the system may have been given to an attacker, consider the system fully compromised and perform a thorough investigation and remediation beyond package removal.