Malicious code in @revizahoshii/hoshino-store-sqlite (npm)

The '@revizahoshii/hoshino-store-sqlite' npm package is identified as malicious software that, when installed or executed, grants full control of the affected computer to an outside entity. This results in a complete system compromise, including exposure of stored secrets and keys. The package should be removed, but because the attacker may have installed additional malware, full remediation requires rotating all secrets and keys from a different, secure machine.

Full system compromise on any computer with the package installed or running. All secrets and keys stored on the compromised system are at risk and should be considered exposed. There is no guarantee that removing the package will remove all malicious components introduced by the attacker.

Remove the '@revizahoshii/hoshino-store-sqlite' package immediately from all affected systems. Rotate all secrets and keys stored on the compromised systems from a separate, secure computer. Due to the potential for persistent malicious software beyond the package itself, consider a full system rebuild or forensic analysis to ensure complete remediation.