The @rafaelsene01/agent-flow npm package versions including 1.0.2, 1.0.3, 1.0.4, 1.2.1, 1.2.2, 1.2.3, 1.3.0, 1.4.0, 1.5.0, 1.5.1, 1.7.0, and 1.9.0 contain malicious code. The main and binary entry point is a heavily obfuscated JavaScript bundle that runs a local Express server bound to 127.0.0.1:5522, which communicates with api.github.com using user-provided GitHub tokens or local authentication tokens. It manages git worktrees and spawns a local CLI tool named 'claude'. There is no evidence of remote code fetching, eval of remote content, or exfiltration beyond GitHub's API. The postinstall hook is inert in published versions. Despite the lack of remote exfiltration, the package is considered fully compromising any host where it is installed or executed, warranting immediate secret rotation and package removal. Obfuscation raises review difficulty but is not itself a supply-chain attack vector.

Any system with this package installed or running should be considered fully compromised. Attackers may have gained full control over the host, risking exposure of all stored secrets and keys. The malicious package may have installed additional undetected malware. Removal of the package alone does not guarantee eradication of all malicious components. Immediate secret and key rotation from a separate, trusted system is necessary to mitigate credential compromise.

Remove the @rafaelsene01/agent-flow package immediately from all affected systems. Rotate all secrets and keys stored on compromised systems from a different, secure machine. Because full system compromise is likely, conduct a thorough investigation and consider rebuilding affected hosts. No official patch or fix is available; the package itself is malicious. Avoid installing or running this package in any environment.