Malicious code in react-emits (npm)

The react-emits package in the npm ecosystem has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing attackers complete control. Due to the severity of the compromise, all credentials and secrets on the affected machine must be considered exposed and rotated from a secure environment. Removal of the package alone is insufficient to ensure system integrity, as additional malicious components may persist.

Complete system compromise on any machine with the react-emits package installed or running. All stored secrets and keys on the compromised system are at risk and must be rotated. The attacker may maintain persistent access beyond the presence of the package itself.

Remove the react-emits package immediately. Rotate all secrets and keys from a separate, uncompromised system. Conduct a thorough investigation and remediation of the affected machine, as removal of the package alone does not guarantee elimination of all malicious software.