Malicious code in @patternfly-4/react-core (npm)

The @patternfly-4/react-core npm package at version 9.9.9 has been identified as containing malicious code. Installation or execution of this package can lead to a full system compromise, potentially granting attackers complete control over the affected computer. Due to the severity of the compromise, simply uninstalling the package does not guarantee removal of all malicious artifacts. Immediate rotation of any secrets or keys stored on the compromised system is strongly advised to prevent further unauthorized access.

Any system with the affected package installed or running is considered fully compromised. Attackers may have obtained full control over the system, putting all stored secrets and keys at risk. The malicious code presence may persist beyond removal of the package, increasing the risk of ongoing unauthorized access or damage.

Remove the @patternfly-4/react-core package version 9.9.9 immediately from affected systems. Rotate all secrets and keys stored on the compromised computer using a different, secure device. Because full control of the system may have been given to an attacker, consider rebuilding or thoroughly cleaning the system to ensure complete removal of malicious software.