Malicious code in randomunblockedwebsite (npm)

The npm package 'randomunblockedwebsite' in versions 1.0.0, 1.0.1, and 1.0.2 has been identified as containing malicious code or relying on a dependency that contains malicious code. According to sources including Amazon Inspector and GHSA malware advisories, any system with this package installed should be considered fully compromised. The malicious code presence implies that attackers may have gained full control of the affected system. The package removal is necessary but insufficient to guarantee full remediation due to possible persistence mechanisms. Immediate rotation of all secrets and keys stored on the compromised system is strongly advised, performed from a different, secure machine.

Systems with the affected versions of the 'randomunblockedwebsite' package installed are considered fully compromised. Attackers may have gained full control over the system, risking exposure of all stored secrets and keys. The compromise may persist beyond removal of the package, indicating a high risk of continued unauthorized access or data theft.

Remove the 'randomunblockedwebsite' package immediately from all affected systems. Rotate all secrets and keys stored on the compromised systems using a separate, secure computer. Due to the potential for full system compromise, consider rebuilding or thoroughly cleaning affected systems to ensure removal of all malicious components. Monitor for any unusual activity that may indicate persistence or further compromise.