Malicious code in svelte-ui-cls (npm)

The svelte-ui-cls npm package is identified as containing malicious code that fully compromises the host system upon installation or execution. The compromise allows an attacker to potentially control the affected computer, putting all stored secrets and keys at risk. Due to the nature of the compromise, simply uninstalling the package is insufficient to ensure system integrity, as additional malicious software may have been installed.

Any system with the svelte-ui-cls package installed or running should be considered fully compromised. This includes potential unauthorized access to all secrets and keys stored on the system. The attacker may have persistent control beyond the presence of the package itself.

Remove the svelte-ui-cls package immediately. Rotate all secrets and keys from a separate, uncompromised device. Because full system compromise is likely, consider rebuilding the affected system to ensure complete removal of malicious software.