The npm package [email protected] has been flagged as malicious by multiple sources including Amazon Inspector and GHSA malware advisories. Despite the absence of install-time lifecycle hooks, credential access, network exfiltration, droppers, silent-relay, or backdoor mechanisms in the scanned files, the package is considered to fully compromise any system where it is installed. The advisory recommends treating any computer with this package as fully compromised, necessitating immediate secret and key rotation from a separate machine and removal of the package. Due to potential persistent malicious software beyond the package itself, removal alone may not restore system integrity.

Any system with [email protected] installed or running should be considered fully compromised. Attackers may have gained full control, risking exposure of all secrets and keys stored on the system. The compromise may extend beyond the package itself, potentially leaving persistent malicious software even after package removal.

Remove the [email protected] package immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted computer. Because full system compromise is possible, consider a full system rebuild or forensic analysis to ensure removal of all malicious artifacts. Monitor for any suspicious activity post-remediation.