Malicious code in neighbor-key-map (npm)

The 'neighbor-key-map' npm package version 2.1.4 has been identified as containing malicious code or relying on a dependency that contains malicious code. According to sources including Amazon Inspector and the GitHub Security Advisory for malware, any system with this package installed should be considered fully compromised. The malicious code may grant an attacker full control over the system, compromising all secrets and keys stored on it. Removal of the package alone may not fully eradicate the malicious presence due to potential persistence mechanisms.

Systems with 'neighbor-key-map' version 2.1.4 installed are at risk of full compromise. Attackers may gain complete control over the affected computer, leading to exposure and potential theft of all stored secrets and keys. This level of compromise can have severe consequences for confidentiality and integrity of data on the system.

Remove the 'neighbor-key-map' package version 2.1.4 immediately from all affected systems. Rotate all secrets and keys that were stored on the compromised machines from a separate, trusted computer. Due to the possibility of persistent malicious software, consider a full system reinstallation or forensic analysis to ensure complete eradication of the threat.