The npm package svelte-mapped-metrics version 1.0.0 has been flagged as malicious by multiple sources. Amazon Inspector found no signs of credential access, remote code execution, or suspicious network/file activity during lifecycle events. However, the GHSA-malware source states that any computer with this package installed should be considered fully compromised, recommending immediate secret rotation and package removal. There is no indication of a patch or fix, and the package should be treated as a malicious package rather than a typical vulnerability.

Systems with [email protected] installed are considered fully compromised, implying potential unauthorized control by an attacker. All secrets and keys on the affected system may be exposed and must be rotated. Removal of the package does not guarantee complete remediation due to possible persistence of malicious software.

Remove the svelte-mapped-metrics package version 1.0.0 immediately from all affected systems. Rotate all secrets, keys, and credentials stored on the compromised systems from a separate, trusted environment. Due to the likelihood of full system compromise, consider rebuilding or thoroughly cleaning affected systems to ensure removal of all malicious components.