Malicious code in svelte-dim-ui (npm)

The 'svelte-dim-ui' npm package version 1.0.0 was found to include malicious code or relies on a dependency that contains malicious code. According to Amazon Inspector and GHSA malware sources, any system with this package installed should be considered fully compromised. The malicious code can grant an attacker full control over the affected system, risking exposure of all stored secrets and keys. Removing the package alone may not fully remediate the compromise due to potential persistence of malicious software.

Systems with 'svelte-dim-ui' version 1.0.0 installed are at risk of full compromise, including unauthorized access to all secrets and keys stored on the machine. This can lead to severe security breaches and loss of sensitive information.

Remove the 'svelte-dim-ui' package version 1.0.0 immediately. Rotate all secrets and keys from a different, uncompromised machine. Because full control of the system may have been given to an attacker, additional forensic analysis and remediation steps may be necessary. No official patch or fix is available; the package should be considered unsafe.