Malicious code in passsport1 (npm)

The 'passsport1' npm package version 1.0.1 is identified as containing malicious code that compromises the host system completely. According to the source details, installation or execution of this package results in full system compromise, including potential exposure of stored secrets and keys. The malicious nature of the package means that simply uninstalling it may not remove all backdoors or malware installed as a result. The advisory recommends urgent secret rotation from a secure environment to mitigate ongoing risk.

Any system with 'passsport1' version 1.0.1 installed or running should be considered fully compromised. This includes potential unauthorized access to all stored secrets and keys, which could lead to further breaches or misuse of credentials. The persistence of malicious software beyond package removal increases the risk and complexity of remediation.

Remove the 'passsport1' package version 1.0.1 immediately from affected systems. Rotate all secrets and keys stored on the compromised computer from a separate, secure machine. Due to the likelihood of persistent malicious software, consider conducting a full system forensic analysis and remediation. No official patch or fix is available; the package itself is malicious.