The pino-pretty-logs package versions 1.1.0 and 2.0.0 distributed via npm contain embedded malicious code. This malware grants attackers full control over affected systems, compromising all stored secrets and keys. Due to the severity of the compromise, affected systems should be considered fully compromised, and remediation requires secret rotation from a clean environment. Removal of the package alone is insufficient to ensure system integrity.

Any system with the affected versions of pino-pretty-logs installed is fully compromised, potentially exposing all stored secrets and keys. Attackers may have persistent control over the system, making it unsafe to trust the system until complete remediation is performed.

Remove the malicious pino-pretty-logs package immediately. Rotate all secrets and keys from a different, uncompromised computer. Because full system compromise is likely, consider rebuilding the affected system from a trusted backup or reinstalling the operating system to ensure removal of all malicious components.