Malicious code in svelte-ui-dim (npm)

The svelte-ui-dim package version 1.0.0 was identified as containing malicious code or relying on a dependency that is malicious. According to sources including Amazon Inspector and the GitHub Security Advisory for malware, any system with this package installed should be considered fully compromised. The malicious code can provide attackers with full control over the affected system, necessitating urgent remediation steps including secret rotation and package removal.

Systems with svelte-ui-dim version 1.0.0 installed are at risk of full compromise. Attackers may gain complete control over the system, potentially accessing or exfiltrating all stored secrets and keys. This level of compromise can lead to severe security breaches and data loss.

Remove the svelte-ui-dim package version 1.0.0 immediately from all affected systems. Rotate all secrets and keys from a separate, trusted computer to prevent further unauthorized access. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the affected machines to ensure removal of all malicious artifacts. No official patch or fix is currently available; remediation relies on removal and secret rotation.