The rdfxvela npm package embeds a base64-encoded RSA private key within its CLI code. Invoking any rx subcommand causes the CLI to decode this key, write it to a temporary file with restrictive permissions, and use it to SSH into a remote server owned by the package author. This allows the author to execute commands remotely on that server. Additionally, user-supplied passwords are interpolated unescaped into remote shell commands, exposing sensitive credentials in process arguments and logs on the remote host. The package does not exfiltrate data or execute remote code on the installer's machine, and the shared SSH credential only grants access to the author's infrastructure. However, the presence of this package on a system implies a full compromise of that system, as the author can control the remote server and potentially leverage that access maliciously.

Any system with the rdfxvela package installed or running is considered fully compromised. The embedded private key allows the package author to access a remote server via SSH, and user passwords are exposed in remote command arguments and logs. Although the compromise is limited to the author's infrastructure, the package's presence indicates a severe security breach. All secrets and keys stored on the compromised system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software or backdoors that may have been installed.

No official patch or remediation is currently available. Users should immediately remove the rdfxvela package from their systems. All secrets, credentials, and keys stored on affected machines must be rotated from a secure environment. Because the package grants remote access to the author's infrastructure and exposes user passwords, affected systems should be treated as fully compromised and undergo thorough incident response procedures. Monitor for any unauthorized access or persistence mechanisms resulting from this compromise.