Malicious code in node-telegram-sockets (npm)

The node-telegram-sockets package distributed via npm has been identified as containing malicious code. Installation or execution of this package results in a full system compromise, granting attackers complete control over the infected computer. The malicious nature of this package means that simply removing it may not eliminate all backdoors or malware introduced. The advisory strongly recommends rotating all secrets and keys stored on the compromised system from a different, secure computer to prevent further unauthorized access.

Systems with the node-telegram-sockets package installed or running are fully compromised, potentially exposing all stored secrets and keys. Attackers may have persistent access and control, making the affected systems untrustworthy until fully remediated. The compromise can lead to data theft, unauthorized actions, and further malware installation.

Remove the node-telegram-sockets package immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure device. Due to the full compromise, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components. No official patch or fix is available; the best mitigation is removal and secret rotation.