The npm package [email protected] is flagged as malicious. Static and behavioral analysis found no install-time lifecycle hooks, credential theft, network exfiltration, droppers, or backdoors within the package contents. However, security advisories indicate that any system with this package installed should be considered fully compromised, implying the presence of malicious code or side effects not detected by automated tools. Immediate secret rotation and package removal are recommended, but full remediation may require more extensive incident response due to potential persistent compromise.

Any computer with [email protected] installed or running is considered fully compromised, risking exposure of all stored secrets and keys. The presence of this package may allow an attacker full control over the affected system. Simply removing the package does not guarantee removal of all malicious components introduced, indicating potential persistence mechanisms or additional malware installed alongside.

Remove the [email protected] package immediately. Rotate all secrets and keys stored on the affected system from a different, secure computer. Treat the affected system as fully compromised and conduct a thorough incident response to identify and remove any additional malicious software or persistence mechanisms. There is no known patch or fixed version; avoid using this package entirely.