The supersig npm package version 1.0.5 ships with malicious code embedded in its distributed bundles (dist/supersig.cjs.js, dist/supersig.esm.js, dist/supersig.umd.js) that is absent from the source code. This code imports a DES key from an unpinned dependency mkb-manager@latest, decrypts an embedded encrypted token to plaintext code, and executes it by spawning a new Node.js child process and writing the decrypted code to its stdin. Because mkb-manager is pinned to latest, the decryption key and payload can be rotated at will by the dependency's maintainer, making the executed code opaque and mutable. The concealment of this dropper code from the source tree indicates deliberate malicious intent. Systems with this package installed are fully compromised.

Any computer with supersig version 1.0.5 installed or running is considered fully compromised. The malicious code executes arbitrary payloads controlled via an external dependency, potentially allowing complete system takeover. All secrets and keys stored on the compromised system should be rotated immediately from a different, trusted system. Removing the package alone does not guarantee removal of all malicious software or backdoors installed as a result of this compromise.

Immediate removal of the supersig package version 1.0.5 is recommended. All secrets and cryptographic keys on affected systems should be rotated from a secure, uncompromised environment. Due to the nature of the compromise, full system reimaging or forensic analysis is advised to ensure no persistent malicious code remains. There is no indication of an official patch or fix; therefore, avoid using this package version entirely.