The npm package statist-browser-typed-client-eventea.projects.pwakasko version 0.0.1 is classified as malicious software. Analysis from amazon-inspector found no explicit code for credential access or network exfiltration, but the GHSA-malware source indicates that any system with this package installed should be considered fully compromised. The package contains only two files, with no lifecycle hooks or suspicious network destinations detected. Despite this, the presence of the package implies a full compromise, necessitating immediate secret rotation and removal of the package, although removal may not fully clean the system.

Systems with this package installed are considered fully compromised. Attackers may have gained complete control, risking exposure of all stored secrets and keys. The package's installation implies a severe security breach, and simply uninstalling the package does not guarantee removal of all malicious artifacts.

Remove the malicious package immediately. Rotate all secrets and keys stored on the affected system from a separate, trusted computer. Due to the likelihood of full system compromise, consider rebuilding the system or conducting a thorough forensic analysis to ensure all malicious components are eradicated. No official patch or fix is available for this malicious package.