Malicious code in passtpor (npm)

The 'passtpor' npm package version 1.0.1 has been identified as containing malicious code that compromises the host system completely. According to the source details, any system with this package installed should be considered fully compromised, requiring immediate rotation of all secrets and keys from a separate, secure machine. The malicious package may have installed additional malware or backdoors, making removal of the package insufficient to restore system integrity.

Full system compromise on any computer with the 'passtpor' package version 1.0.1 installed. All secrets and keys stored on the compromised system are at risk and should be considered exposed. The attacker may have persistent access beyond just the presence of the malicious package.

Remove the 'passtpor' package version 1.0.1 immediately. Rotate all secrets and keys from a different, uncompromised computer. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components.