Malicious code in schoolhomework (npm)

The 'schoolhomework' npm package version 1.0.0 was identified by Amazon Inspector and GitHub Security Advisory as containing malicious code or consuming a dependency that contains malicious code. This malicious package can lead to full compromise of any computer where it is installed or executed. The advisory warns that all secrets and keys stored on the compromised system should be rotated immediately from a separate, secure computer. Removing the package alone may not fully eradicate the malicious presence due to potential persistent control by an attacker.

Any computer with the 'schoolhomework' package version 1.0.0 installed or running should be considered fully compromised. Attackers may have gained full control, risking exposure and theft of all stored secrets and keys. The compromise can lead to persistent malicious activity beyond the presence of the package itself.

Remove the 'schoolhomework' package version 1.0.0 immediately. Rotate all secrets and keys from a different, uncompromised computer to prevent unauthorized access. Because the system may be fully compromised, consider a full system reinstallation or forensic analysis to ensure complete removal of malicious software.