Malicious code in @revizahoshii/hoshino-store-mongo (npm)

The package @revizahoshii/hoshino-store-mongo distributed via npm has been identified as containing malicious code. Installation or execution of this package results in a full system compromise, potentially allowing an attacker to control the affected computer. Due to the severity of the compromise, all sensitive credentials stored on the system must be rotated from a separate, secure environment. Removal of the package alone is insufficient to ensure system integrity, as additional malicious software may have been installed.

Full compromise of any system with the package installed or running. Attackers may have gained persistent control, risking exposure of all stored secrets and keys. The system's security posture is critically undermined, requiring immediate credential rotation and thorough remediation.

Immediately remove the @revizahoshii/hoshino-store-mongo package from all affected systems. Rotate all secrets and keys stored on compromised machines from a different, secure computer. Conduct a comprehensive security assessment and remediation to identify and remove any additional malicious software or backdoors that may have been installed. Do not rely solely on package removal to restore system integrity.