The 's3-lambda-dynamodb-cdk' npm package has been identified as containing malicious code that compromises the security of any system where it is installed. According to the source details, the package may provide an attacker with full control over the compromised computer, potentially exposing all stored secrets and keys. The compromise is severe enough that simply uninstalling the package does not guarantee removal of all malicious artifacts. No CVSS score or detailed technical exploit information is provided. No patch or remediation beyond removal and secret rotation is indicated.

Systems with this package installed are considered fully compromised, with potential unauthorized access to all secrets and keys stored on the machine. The attacker may have persistent control beyond the presence of the package itself, posing a high risk of data breach and system integrity loss.

Remove the 's3-lambda-dynamodb-cdk' package immediately from all affected systems. Rotate all secrets and keys stored on the compromised machines from a different, secure computer. Because full control may have been granted to an attacker, further forensic analysis and system remediation may be necessary. No official patch or fix is available; mitigation relies on removal and secret rotation.