Malicious code in @saazkira/libsignal-node (npm)

The @saazkira/libsignal-node package distributed via npm is identified as malicious. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker to gain complete control. Due to the severity of the compromise, all sensitive credentials and keys on the affected system must be rotated from a separate, uncompromised device. Simply uninstalling the package is insufficient to ensure system integrity, as the attacker may have installed additional persistent malicious components.

Full system compromise on any computer with the package installed or running. Potential exposure and theft of secrets and keys stored on the system. Persistent attacker control may remain even after package removal.

Immediately remove the @saazkira/libsignal-node package from affected systems. Rotate all secrets and keys from a different, trusted computer. Conduct a thorough investigation and remediation of the affected system, as removal of the package alone does not guarantee elimination of all malicious software or attacker presence.