The npm package @settle-sea/supporting-documents at version 99.9.1 has been identified as malicious by multiple sources including Amazon Inspector, GHSA malware reports, and the OpenSSF Package Analysis project. The package contains code that communicates with a domain associated with malicious activity, indicating potential backdoor or data exfiltration behavior. Systems with this package installed or running should be considered fully compromised, with all stored secrets and keys at risk. No patch or fixed version is indicated, and remediation requires removal of the package and rotation of credentials.

Systems with the malicious package installed or running are considered fully compromised. Attackers may have gained full control, risking exposure of all secrets and keys stored on the system. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the package.

Remove the @settle-sea/supporting-documents package version 99.9.1 immediately. Rotate all secrets and keys stored on the affected system from a different, secure computer. Because full system compromise is likely, consider rebuilding or thoroughly cleaning the affected environment. No official patch or fixed version is currently available; monitor vendor or repository advisories for updates.