Malicious code in priority-slot-queue (npm)

The 'priority-slot-queue' npm package version 3.2.3 has been identified as containing malicious code or relying on a dependency that contains malicious code. According to sources including Amazon Inspector and GitHub Security Advisories, any system with this package installed or running should be considered fully compromised. The malicious code may grant an attacker full control over the affected system, necessitating urgent secret and key rotation from a secure environment. Removal of the package alone does not guarantee elimination of all malicious artifacts.

Systems with 'priority-slot-queue' version 3.2.3 installed or running are at risk of full compromise. Attackers may gain complete control over the system, exposing all stored secrets and keys. This can lead to unauthorized access, data theft, and further system compromise. The presence of this package represents a critical security risk.

Remove the 'priority-slot-queue' package version 3.2.3 immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, secure computer. Because full control may have been granted to an attacker, simply removing the package may not fully remediate the compromise. Conduct a thorough investigation and consider rebuilding affected systems if necessary.