Malicious code in rtms-manager-dev (npm)

The rtms-manager-dev npm package versions 1.3.0 and 1.4.0 have been identified as containing malicious code. Installation or execution of these versions results in a full system compromise, potentially allowing attackers to control the affected computer. The malicious package is confirmed by the GHSA advisory GHSA-88hw-5c75-wg74 and is cataloged under MAL-2026-14093. There is no CVSS score available for this threat. No official patch or fix is provided, and the vendor advisory does not indicate any remediation beyond removal and secret rotation.

Systems with rtms-manager-dev versions 1.3.0 or 1.4.0 installed or running should be considered fully compromised. Attackers may have gained full control over the system, risking exposure or theft of sensitive data, credentials, and keys. The presence of this malicious package undermines system integrity and confidentiality.

Remove the rtms-manager-dev package versions 1.3.0 and 1.4.0 immediately from all affected systems. Rotate all secrets, keys, and credentials stored on the compromised systems using a separate, secure device. Due to the potential for persistent malicious software, consider rebuilding or thoroughly cleaning affected systems to ensure complete remediation. No official patch or fix is available; rely on removal and secret rotation as primary mitigation steps.