The @torbeck/priority-queue npm package is a repackaged version of the legitimate @datastructures-js/priority-queue, but it abuses npm alias syntax in its package.json to replace the legitimate @datastructures-js/heap dependency with a malicious sibling package @torbeck/[email protected] published by the same untrusted maintainer. When @torbeck/priority-queue is imported, it loads the malicious @torbeck/heap package instead of the legitimate heap package, enabling potential full compromise of the host system. The malicious code is contained in @torbeck/heap and must be analyzed separately. Systems with this package installed should be considered fully compromised.

Any computer with @torbeck/priority-queue installed is at risk of full compromise due to the malicious dependency substitution. Attackers may gain full control, potentially accessing all secrets and keys stored on the system. Removal of the package alone does not guarantee eradication of the compromise, necessitating secret and key rotation from a clean environment.

Remove the @torbeck/priority-queue package immediately if installed. Rotate all secrets and keys stored on the affected system from a different, trusted computer. Because the malicious payload resides in the aliased @torbeck/heap package, ensure no remnants remain. Monitor for any suspicious activity and consider system reimaging if compromise is suspected. Patch status is not confirmed; check vendor advisories for updates on remediation.