Malicious code in sonsonsahur (npm)

The 'sonsonsahur' npm package version 1.0.0 has been identified as containing malicious code or relying on a malicious dependency. According to sources including Amazon Inspector and GHSA malware advisories, any system with this package installed should be considered fully compromised. The malicious code may grant attackers full control over the system, necessitating immediate rotation of all secrets and keys from a separate, uncompromised device. Simply uninstalling the package does not guarantee removal of all malicious components introduced by it.

Systems with 'sonsonsahur' version 1.0.0 installed are at risk of full compromise, including unauthorized access to secrets and keys stored on the system. This can lead to severe security breaches and loss of sensitive information. The compromise may persist even after removal of the package.

Remove the 'sonsonsahur' package version 1.0.0 immediately from all affected systems. Rotate all secrets, keys, and credentials from a different, uncompromised computer. Due to the potential for persistent malicious software, consider performing a full system forensic analysis and remediation to ensure complete removal of the threat.