The svelte-kit-cache package version 1.0.0 on npm has been flagged as malicious. Amazon Inspector analysis found no direct evidence of supply-chain attack behaviors such as lifecycle scripts fetching remote content or exfiltration endpoints. However, the GHSA malware advisory states that any computer with this package installed should be considered fully compromised, implying the package contains malicious code that grants full control to an attacker. Removal of the package alone may not eliminate all malicious artifacts, and secrets and keys must be rotated from a separate, uncompromised system.

Systems with svelte-kit-cache version 1.0.0 installed are considered fully compromised, potentially allowing attackers full control. All secrets and keys stored on the affected system are at risk and must be rotated. Removing the package does not guarantee removal of all malicious software introduced by it.

Remove the svelte-kit-cache package version 1.0.0 immediately. Rotate all secrets and keys stored on the affected system from a different, uncompromised computer. Consider rebuilding or thoroughly cleaning the affected system to ensure complete removal of malicious software.