Malicious code in @revizahoshii/hoshino-store-mysql (npm)

The '@revizahoshii/hoshino-store-mysql' package distributed via npm has been identified as containing malicious code. Installation or execution of this package results in a full system compromise, potentially allowing attackers to control the affected computer. The malicious code may persist beyond removal of the package, necessitating secret and key rotation from a separate, uncompromised system to mitigate ongoing risk.

Any system with this package installed or running should be considered fully compromised. Attackers may have gained full control over the system, including access to stored secrets and keys. Removal of the package alone does not guarantee elimination of all malicious software introduced by the package.

Remove the '@revizahoshii/hoshino-store-mysql' package immediately from affected systems. Rotate all secrets and keys stored on the compromised computer from a different, secure device. Due to the potential persistence of malicious software, consider a full system audit and remediation to ensure complete removal of the threat.