Malicious code in schoollesson (npm)

The 'schoollesson' npm package version 1.0.0 has been identified as containing malicious code or relying on a dependency that contains malicious code. This malicious code can lead to a full compromise of any computer where the package is installed or executed. Due to the severity of the compromise, all secrets and keys on the affected system should be considered exposed and must be rotated from a secure environment. Removal of the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.

Any system with 'schoollesson' version 1.0.0 installed or running is considered fully compromised. Attackers may have gained full control, risking exposure of all stored secrets and keys. The compromise is severe enough that simply uninstalling the package does not guarantee removal of all malicious artifacts or backdoors.

Remove the 'schoollesson' package version 1.0.0 immediately from all affected systems. Rotate all secrets, keys, and credentials from a separate, trusted machine to prevent further unauthorized access. Due to the potential for persistent compromise, consider rebuilding or thoroughly cleaning affected systems to ensure removal of all malicious components.