The npm package @telekom-wfa/auth-core in versions 99.9.11 and 99.9.12 is identified as malware. It contains hardcoded Telegram credentials, performs data exfiltration, and runs a preinstall script to facilitate malicious activity. Installation of this package can lead to full system compromise, allowing attackers to gain control and access sensitive information. Immediate remediation involves removing the package and rotating all secrets and keys from a different, uncompromised system.

Any computer with the affected versions of @telekom-wfa/auth-core installed is considered fully compromised. Attackers may have gained full control over the system, potentially accessing and exfiltrating sensitive data and credentials. The presence of hardcoded Telegram credentials and preinstall script execution further confirms malicious intent and active exploitation capabilities. Secrets and keys stored on the compromised system are at risk and must be rotated immediately.

Remove the malicious package @telekom-wfa/auth-core versions 99.9.11 and 99.9.12 from all affected systems. Consider all affected systems fully compromised and rotate all secrets and keys from a separate, secure device. Due to the potential for full system compromise, additional forensic analysis and remediation may be necessary beyond package removal.