Malicious code in pushgitquickx (npm)

The pushgitquickx npm package versions 1.0.0 through 1.0.17 contain malicious code that, when installed or executed, can fully compromise the host system. This compromise includes potential unauthorized access to sensitive information such as secrets and keys. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors introduced by the attacker. Immediate secret and key rotation from a secure environment is recommended to mitigate risk.

Any system with the affected pushgitquickx package installed or running should be considered fully compromised. Attackers may have gained full control over the system, including access to stored secrets and keys. This can lead to further unauthorized access, data theft, or lateral movement within the environment. The persistence of malicious code beyond package removal increases the risk and complexity of remediation.

Remove the pushgitquickx package immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, secure environment. Because full system compromise is possible, consider rebuilding affected systems to ensure complete removal of malicious code and backdoors. Monitor for any suspicious activity related to the compromised environment. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.