Malicious code in originaldevelopmentstelemetry (npm)

The 'originaldevelopmentstelemetry' package in the npm ecosystem is identified as malicious. Installation or execution of this package results in a full compromise of the host system, potentially allowing attackers to access sensitive information such as secrets and keys. Due to the nature of the compromise, simple removal of the package is insufficient to restore system integrity, as additional malicious software may have been installed. Immediate secret rotation from a separate secure environment is recommended to mitigate ongoing risk.

Full system compromise on any computer with the package installed or running. All stored secrets and keys on the affected system are at risk and should be considered exposed. The attacker may have persistent access beyond the presence of the package itself.

Remove the 'originaldevelopmentstelemetry' package immediately. Rotate all secrets and keys stored on the affected system from a different, secure computer. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the affected machine to ensure removal of all malicious components.