Malicious code in ordered-kv-index (npm)

The 'ordered-kv-index' npm package version 1.0.1 was found to contain malicious code or a dependency with malicious code, as reported by Amazon Inspector and GHSA malware sources. Any system with this package installed or running should be considered fully compromised. The malicious code may allow an attacker full control over the system, risking exposure of all stored secrets and keys. Due to the potential for persistent malicious software beyond the package itself, simply uninstalling the package may not fully remediate the compromise.

Systems with 'ordered-kv-index' version 1.0.1 installed or running are considered fully compromised. Attackers may have gained full control over the system, risking theft or misuse of all secrets and keys stored on the device. The compromise may persist beyond removal of the package, indicating a severe security impact.

Remove the 'ordered-kv-index' package version 1.0.1 immediately. Rotate all secrets and keys stored on the affected system from a different, uncompromised computer. Because full control may have been given to an attacker, further forensic analysis and system restoration may be necessary. No official patch or fix is indicated; avoidance of this package version is recommended.