The npm package nodemon-async version 3.1.13 has been identified as containing malicious code or relying on a dependency that includes malicious code. This malicious package can fully compromise any computer on which it is installed or running. The compromise includes potential unauthorized access and control, necessitating immediate secret and key rotation from a different, secure machine. Due to the depth of compromise, simply uninstalling the package does not guarantee removal of all malicious components or backdoors.

Systems with nodemon-async version 3.1.13 installed or running should be considered fully compromised. Attackers may have gained full control over the system, risking exposure and theft of sensitive information including secrets and keys. The integrity and confidentiality of the affected system are severely impacted, requiring urgent remediation steps beyond package removal.

Remove the nodemon-async package version 3.1.13 immediately. Rotate all secrets and keys that were stored or used on the compromised system from a separate, secure device. Because full control may have been given to an attacker, consider the system fully compromised and perform a thorough incident response, including system rebuild or restoration from a known good backup. Patch status is not applicable as this is a malicious package rather than a vulnerability with an official fix.