Malicious code in @revizahoshii/hoshino-fake-server (npm)

The npm package @revizahoshii/hoshino-fake-server is identified as containing malicious code that can fully compromise a host system. Any computer with this package installed or running should be considered fully compromised. The attacker may have gained full control, risking exposure of all stored secrets and keys. The package should be removed, but because of the potential for persistent malicious software beyond the package itself, additional remediation steps such as rotating all secrets and keys from a separate, trusted system are necessary.

Full system compromise on any computer with the package installed or running. All secrets and keys stored on the compromised computer are at risk and should be considered exposed. Removal of the package does not guarantee removal of all malicious software introduced by the package.

Remove the @revizahoshii/hoshino-fake-server package immediately. Rotate all secrets and keys stored on the affected computer from a separate, trusted machine. Conduct a thorough investigation and remediation of the compromised system, as removal of the package alone may not eliminate all malicious components.