Malicious code in sliding-score-window (npm)

The sliding-score-window npm package version 2.3.5 contains malicious code or depends on a malicious package. Systems with this package installed or running should be considered fully compromised. The malicious code may allow attackers to gain full control over the affected system. Immediate secret and key rotation from a secure environment is recommended. Removal of the package alone is insufficient to ensure system integrity due to potential persistence mechanisms.

Full system compromise is indicated for any computer with the affected package installed or running. Attackers may have access to all secrets and keys stored on the system. The integrity and confidentiality of the affected system are severely impacted, requiring urgent remediation and secret rotation.

Remove the sliding-score-window package version 2.3.5 immediately. Rotate all secrets and keys stored on the compromised system from a different, secure computer. Because full control of the system may have been granted to an attacker, further forensic analysis and system restoration from a trusted backup are recommended. No official patch or fix is indicated; remediation relies on removal and secret rotation.