Malicious code in svelte-dim-kit (npm)

The svelte-dim-kit package (version 1.0.0) was identified by Amazon Inspector and GHSA as containing malicious code or relying on a dependency that contains malicious code. This malicious code can lead to a full system compromise, allowing attackers to gain control over the affected computer. The advisory warns that simply uninstalling the package may not remove all malicious components, and that secrets and keys stored on the compromised system should be rotated from a separate, secure machine.

Systems with svelte-dim-kit version 1.0.0 installed are at risk of full compromise, including unauthorized access and control by attackers. Sensitive information such as secrets and keys stored on the system may be exposed or stolen. The presence of malicious code can lead to persistent threats even after package removal.

Remove the svelte-dim-kit package version 1.0.0 immediately. Rotate all secrets and keys stored on the affected system from a different, secure computer. Because full control of the system may have been compromised, consider a full system rebuild or forensic analysis to ensure all malicious software is eradicated. Patch status is not confirmed; no official fix or patch is indicated.