Malicious code in serpacksven (npm)

The 'serpacksven' package in the npm ecosystem is identified as containing malicious code. Installation or execution of this package results in a full compromise of the host computer. The attacker may have gained persistent control, making remediation difficult. Immediate secret and key rotation from a different machine is required to mitigate potential credential theft or misuse. The package should be removed, but this action alone may not fully eradicate the threat due to possible additional malware installed by the attacker.

Full system compromise on any computer with the 'serpacksven' package installed or running. Potential exposure and theft of stored secrets and keys. Persistent attacker control may remain even after package removal, posing ongoing risk to system integrity and confidentiality.

Remove the 'serpacksven' package immediately. Rotate all secrets and keys stored on the compromised machine from a separate, secure computer. Due to the likelihood of persistent compromise, consider a full system rebuild or forensic analysis to ensure complete removal of malicious components.