Malicious code in skillward (npm)

The 'skillward' npm package versions 0.1.1 and 0.1.2 have been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, granting attackers potential control over the machine. The compromise is severe enough that removal of the package alone does not guarantee eradication of all malicious software introduced. Immediate secret and key rotation from a separate, uncompromised system is advised to mitigate further damage.

Any system with 'skillward' versions 0.1.1 or 0.1.2 installed or running should be considered fully compromised. Attackers may have gained full control over the system, risking exposure and theft of all stored secrets and keys. The presence of this package on a system indicates a critical security breach with potentially severe consequences.

Remove the 'skillward' package versions 0.1.1 and 0.1.2 immediately from affected systems. Due to the likelihood of full system compromise, assume that other malicious software may be present and conduct a thorough incident response. Rotate all secrets and keys stored on the compromised machine from a separate, secure computer. No official patch or fix is available; remediation relies on removal and secret rotation.