Malicious code in soccketio (npm)

The soccketio package version 1.0.1 distributed via npm contains embedded malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker complete control. Due to the severity of the compromise, all sensitive credentials on the affected machine must be considered exposed and rotated from a secure environment. The package removal does not ensure eradication of all malicious artifacts introduced by the attacker.

Full system compromise on any computer with soccketio version 1.0.1 installed or running. Exposure of all stored secrets and keys on the affected machine. Potential persistent malicious presence beyond the package itself.

Immediately remove the soccketio package version 1.0.1 from all affected systems. Rotate all secrets and keys stored on the compromised machine from a different, secure computer. Conduct a thorough investigation and remediation of the affected system as removal of the package alone may not eliminate all malicious software.