Malicious code in parxleys (npm)

The 'parxleys' package in the npm ecosystem has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker to control the computer and access sensitive information. The advisory warns that simply removing the package may not fully remediate the infection, as additional malicious software could have been installed. It is critical to rotate all secrets and keys from a different, uncompromised device to prevent further unauthorized access.

Full system compromise on any computer with the 'parxleys' package installed or running. This includes potential unauthorized access to all stored secrets and keys, which may be exfiltrated or misused. The system integrity and confidentiality are severely impacted.

Remove the 'parxleys' package immediately from all affected systems. Rotate all secrets and keys stored on the compromised machines using a separate, secure computer. Due to the possibility of persistent malicious software beyond the package itself, consider a full system reinstallation or forensic analysis to ensure complete remediation. Patch status is not applicable as this is a malicious package rather than a vulnerability with a vendor fix.