Malicious code in @patternfly-4/react-tokens (npm)

The @patternfly-4/react-tokens package at version 9.9.9 on npm has been identified as containing malicious code. Installation or execution of this package can lead to full system compromise, potentially allowing an attacker to gain control over the affected computer. Due to the severity of the compromise, all secrets and keys stored on the machine should be rotated from a separate, secure environment. The package removal is necessary but may not be sufficient to fully remediate the infection.

Systems with the malicious package installed are considered fully compromised, meaning attackers may have complete control over the affected computer. All stored secrets and keys are at risk and should be rotated immediately. The presence of the package indicates a severe security breach with potential for extensive damage.

Remove the @patternfly-4/react-tokens package version 9.9.9 from all affected systems. Immediately rotate all secrets and keys from a different, uncompromised machine. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the affected environment to ensure all malicious artifacts are removed.