Malicious code in @revizahoshii/hoshino-mcp-server (npm)

The npm package @revizahoshii/hoshino-mcp-server is identified as containing malicious code. Installation or execution of this package results in a full compromise of the affected computer. The malicious code likely provides an attacker with extensive control over the system, including access to stored secrets and keys. Due to the severity of the compromise, simply removing the package may not suffice to restore system integrity. The recommended response includes removal of the package and immediate rotation of all secrets and keys from a different, uncompromised system.

Any system with this package installed or running is considered fully compromised, with potential unauthorized access to all secrets and keys stored on the system. The attacker may have persistent control, and removing the package alone does not guarantee removal of all malicious components.

Remove the @revizahoshii/hoshino-mcp-server package immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted computer. Due to the potential persistence of the malicious code, consider a full system rebuild or forensic analysis to ensure complete remediation.