The npm package statist-browser-typed-client-eventea.projects.pwafamily version 35.8.0 has been flagged as malicious. Analysis from Amazon Inspector found no direct evidence of typical malicious behaviors such as exfiltration or install-time remote code execution in the package files themselves. However, the GHSA malware advisory states that any computer with this package installed or running should be considered fully compromised, implying that the package enables an attacker to gain full control. The advisory recommends immediate removal of the package and rotation of all secrets and keys from a separate, trusted machine. There is no known exploit in the wild and no patch or fix is indicated.

Systems with this package installed or running are considered fully compromised, meaning attackers may have full control over the affected computer. All secrets and keys stored on the compromised machine are at risk and should be rotated. Removing the package alone may not fully remediate the compromise due to potential persistence of malicious software installed as a result of the package.

Remove the statist-browser-typed-client-eventea.projects.pwafamily package version 35.8.0 immediately from all affected systems. Rotate all secrets and keys from a different, uncompromised computer to prevent unauthorized access. Because full system compromise is possible, further forensic investigation and remediation may be necessary. No official patch or fix is available; rely on removal and secret rotation as primary mitigations.