Malicious code in @revizahoshii/hoshino-store-redis (npm)

The @revizahoshii/hoshino-store-redis package is identified as malicious software. According to the source, any system with this package installed should be considered fully compromised. Attackers may have gained full control, potentially accessing sensitive information such as secrets and keys. Immediate rotation of all credentials from a separate, secure system is advised. Simply uninstalling the package may not remove all malicious artifacts or backdoors introduced by the attacker.

Full compromise of the affected system is likely, including unauthorized access to stored secrets and keys. The attacker may maintain persistent control beyond the presence of the malicious package itself, posing ongoing risk to confidentiality and system integrity.

Remove the @revizahoshii/hoshino-store-redis package immediately. Rotate all secrets and keys from a secure, uncompromised system. Assume the affected computer is fully compromised and consider rebuilding or restoring from a known good backup to ensure complete remediation.