Malicious code in svelte-ui-dlx (npm)

The 'svelte-ui-dlx' package in the npm ecosystem has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker to gain complete control. Due to the severity of the compromise, secrets and keys on the affected system must be rotated from a secure, unaffected environment. Simply uninstalling the package does not guarantee removal of all malicious components or backdoors introduced by the attacker.

Full system compromise on any computer with the package installed or running. Potential exposure and theft of all secrets and keys stored on the system. Persistent malicious presence may remain even after package removal, risking ongoing unauthorized access.

Immediately remove the 'svelte-ui-dlx' package from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, secure device. Conduct a thorough investigation and remediation of the affected systems, as removal of the package alone may not eliminate all malicious software or backdoors.