Malicious code in redis-cookie-server (npm)

The redis-cookie-server package distributed via npm has been identified as containing malicious code. According to the source details, any system with this package installed should be considered fully compromised. The attacker may have gained full control over the system, potentially accessing sensitive information such as secrets and keys. Immediate rotation of all credentials from a separate, uncompromised system is advised. Due to the possibility of persistent backdoors or additional malware, simply uninstalling the package may not fully remediate the compromise.

Full system compromise on any computer with the redis-cookie-server package installed. Exposure and potential theft of all secrets and keys stored on the affected system. Persistent attacker control may remain even after package removal.

Remove the redis-cookie-server package immediately. Rotate all secrets and keys from a different, trusted computer. Conduct a thorough investigation and remediation of the affected system, as removal of the package alone may not eliminate all malicious software or attacker persistence.