Malicious code in onceaction (npm)

The 'onceaction' npm package version 5.1.2 has been identified as containing malicious code or relying on a dependency that contains malicious code. According to sources including Amazon Inspector and GHSA malware advisories, any system with this package installed or running should be considered fully compromised. The malicious code can lead to complete system compromise, necessitating immediate secret and key rotation from a secure environment. Removal of the package does not guarantee full remediation due to possible persistent malicious software installed alongside or as a result of the package.

Systems with 'onceaction' version 5.1.2 installed or running are at risk of full compromise. Attackers may gain complete control over the affected computer, potentially accessing all stored secrets and keys. This poses a critical security risk, including unauthorized data access and potential further exploitation.

Immediate removal of the 'onceaction' package version 5.1.2 is recommended. All secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Due to the likelihood of persistent compromise, consider a full system rebuild or forensic analysis to ensure complete removal of malicious software.