Malicious code in nuvyra-marketplace-sdk (npm)

The 'nuvyra-marketplace-sdk' npm package is identified as malicious software. Installation or execution of this package results in a full compromise of the host computer. The attacker potentially gains complete control, risking exposure of all stored secrets and keys. Due to the depth of compromise, simply uninstalling the package is insufficient to ensure system integrity. Immediate secret rotation from a secure environment is required to mitigate ongoing risk.

Full system compromise on any computer with the package installed or running. All stored secrets and keys on the compromised system are at risk and must be rotated. The attacker may maintain persistence beyond removal of the package, indicating potential ongoing control or presence of additional malicious components.

Remove the 'nuvyra-marketplace-sdk' package immediately. Rotate all secrets and keys stored on the affected computer from a separate, trusted machine. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious software. Monitor for any suspicious activity and avoid using the compromised machine for sensitive operations until fully remediated.