The npm package @nolimit-agent/win32-x64, specifically versions 1.0.120, 1.0.122, 1.0.123, 1.0.124, 1.0.125, 1.0.126, 1.0.127, 1.0.128, 1.0.129, 1.0.130, 1.0.131, 1.0.132, 1.0.133, 1.0.134, and 1.0.135, has been identified as containing malicious code or relying on a dependency that contains malicious code. According to sources including Amazon Inspector and the GitHub Security Advisory for malware, any system with this package installed or running should be considered fully compromised. The malicious code can lead to unauthorized control over the system and potential exfiltration of secrets and keys.

Systems with this package installed or running are considered fully compromised, meaning attackers may have gained complete control over the affected computer. All secrets and keys stored on the system are at risk and should be rotated immediately from a separate, secure device. Simply removing the package does not guarantee removal of all malicious software introduced by the package.

Remove the @nolimit-agent/win32-x64 package immediately from affected systems. Rotate all secrets and keys that were stored on the compromised system using a different, secure device. Because full system compromise is possible, consider rebuilding or thoroughly cleaning the affected systems to ensure complete removal of malicious software. No official patch or fix is available; remediation relies on removal and secret rotation.