The npm package @node-cloud/create unconditionally requires the @sql-trigger/nodesql package, which is unrelated in scope and purpose. This pattern suggests dependency smuggling, where the visible package is a facade to deliver a potentially malicious sibling-scoped package. The main package exposes npm publishing helper functions but does not itself perform malicious actions. The critical risk depends on the behavior of @sql-trigger/nodesql, which must be analyzed separately. Security advisories indicate that installation of this package likely results in full system compromise, necessitating secret rotation and removal of the package. No official patch or remediation is documented.

Systems with @node-cloud/create installed or running are considered fully compromised. Attackers may have gained full control, risking exposure of all stored secrets and keys. Removal of the package does not guarantee elimination of all malicious components or persistence mechanisms. Immediate secret rotation from a clean environment is required to mitigate credential exposure.

No official patch or fix is currently available for this malicious package. The recommended mitigation is to immediately remove the @node-cloud/create package from all affected systems. All secrets and keys stored on compromised systems should be rotated from a separate, trusted environment. Monitor for any signs of persistent compromise beyond the package installation.