The @noxzacode/libsignal-node package distributed via npm has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker complete control. Due to the severity of the compromise, all credentials and keys stored on the affected system must be considered exposed and rotated from a secure environment. The package removal does not ensure complete remediation as the attacker may have deployed additional persistent malicious components.

Full system compromise on any computer with the package installed or running. Exposure of all secrets and keys stored on the system. Potential persistent backdoors or malware beyond the package itself.

Immediately remove the @noxzacode/libsignal-node package from affected systems. Rotate all secrets and keys from a separate, uncompromised machine. Conduct a thorough investigation and remediation of the affected system as removal of the package alone does not guarantee full eradication of malicious components.