The uniapi-bridge package distributed via npm has been identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker complete control. Due to the nature of the compromise, simply uninstalling the package may not remove all malicious artifacts or backdoors. This threat is classified as a malicious package rather than a traditional vulnerability. No CVSS score is assigned, and no patch or fix is available since this is a case of malicious software distribution.

Any system with the uniapi-bridge package installed or running should be considered fully compromised. Attackers may have gained complete control, risking exposure or theft of all stored secrets and keys. The integrity and confidentiality of the affected system cannot be assured without full remediation. The presence of this package poses a critical security risk.

Remove the uniapi-bridge package immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on the compromised systems, performing these actions from a separate, trusted environment. Because full control may have been given to an attacker, consider rebuilding or fully restoring affected systems from known good backups. There is no official patch or fix since this is malicious software rather than a vulnerability in legitimate code.