The package @source-row/source-container version 99.9.1 is identified as malicious due to embedded code that communicates with a domain associated with malicious activity. This behavior indicates potential unauthorized control or data exfiltration capabilities. The compromise risk is severe enough that any system with this package installed should be considered fully compromised. The OpenSSF Package Analysis and other sources confirm the malicious nature of this package version. No CVSS score is provided, and no official patch or remediation is documented.

Systems with @source-row/source-container version 99.9.1 installed are at high risk of full compromise. Attackers may have gained unauthorized control, potentially exposing all stored secrets and keys. The presence of malicious communication channels suggests data leakage or further malicious payload delivery. The compromise severity necessitates immediate secret/key rotation and removal of the package, though residual risk remains due to possible persistence mechanisms.

Remove the @source-row/source-container package version 99.9.1 immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, secure environment. Because full system compromise is likely, consider rebuilding affected systems to ensure complete removal of malicious artifacts. No official patch or fix is currently available; monitor vendor or repository advisories for updates.