Malicious code in @pipi596888/ccursor (npm)

The npm package @pipi596888/ccursor versions 0.0.16 and 0.0.17 have been identified as containing malicious code or consuming dependencies with malicious code. According to sources including Amazon Inspector and the GitHub Security Advisory for malware, any system with this package installed or running should be considered fully compromised. The malicious code may grant an attacker full control over the system, compromising all stored secrets and keys. Due to the potential persistence of malicious software beyond the package itself, simply removing the package may not fully remediate the threat.

Systems with the affected versions of @pipi596888/ccursor installed are at risk of full compromise. Attackers may gain complete control over the system, leading to exposure of all stored secrets and keys. This represents a critical security risk as attackers can leverage this access for further malicious activities. The compromise may persist even after package removal.

Remove the affected versions (=0.0.16, =0.0.17) of the @pipi596888/ccursor package immediately. Consider the system fully compromised and perform secret and key rotation from a separate, trusted system. Additional forensic analysis and remediation may be necessary to ensure all malicious artifacts are removed. No official patch or fix is available; the package should be avoided entirely.