The 'nolimit-agent' npm package is a weaponized spam and phishing toolkit distributed with obfuscated JavaScript code to evade detection. It supports bulk SMTP and SMS sending, scanner evasion techniques including obfuscated HTML attachments and SVG-based payload delivery, and DKIM key generation. The package implements OAuth device-code flows against Microsoft and Google to harvest contacts from Microsoft Graph and Google People APIs, storing tokens locally without relaying them to the attacker. It performs license checks via unencrypted HTTP requests. The Windows postinstall script is benign and does not perform network activity. The package does not exfiltrate installer secrets on installation but enables the installer's machine and accounts to be abused for outbound spam and phishing. The obfuscation is designed to defeat registry scanning. Any system with this package installed or running should be considered fully compromised.

Systems with 'nolimit-agent' installed or running are fully compromised, as the package enables mass spam and phishing campaigns using the victim's machine and accounts. OAuth tokens harvested locally can be used to access contacts and prior recipients for further abuse. The package's obfuscation and evasion techniques hinder detection and removal. Secrets and keys stored on the compromised system should be rotated immediately from a clean environment. Removal of the package alone may not eliminate all malicious components or control established by the attacker.

No official patch or fix is available. The package should be removed immediately. Due to the high likelihood of full system compromise, all secrets and keys stored on the affected machine must be rotated from a separate, trusted device. Incident response should assume complete compromise of the host. Monitor for any signs of persistent malicious activity and consider rebuilding the affected system from a known good state.