Malicious code in tungtunggod (npm)

The 'tungtunggod' npm package version 1.0.0 was identified as containing malicious code or relying on a dependency that includes malicious code. According to source reports, any system with this package installed or running should be considered fully compromised. The malicious code may grant an attacker full control over the system, risking exposure of all stored credentials and secrets. Removal of the package alone does not guarantee eradication of all malicious components introduced by it.

Systems with 'tungtunggod' version 1.0.0 installed are at risk of full compromise, including unauthorized access to all secrets and keys stored on the system. This can lead to severe security breaches and potential lateral movement within the affected environment.

Remove the 'tungtunggod' package version 1.0.0 immediately from all affected systems. Rotate all secrets and keys that were stored on compromised systems using a separate, trusted computer. Since full control may have been given to an attacker, further forensic analysis and remediation may be necessary. No official patch or fix is available; the package should be considered unsafe and avoided.