Malicious code in vcse (npm)

The 'vcse' npm package versions 1.0.0 and 1.0.1 have been identified as containing malicious code. Installation or execution of this package results in a full system compromise, potentially allowing attackers to control the affected computer. The package is flagged as malicious by the GHSA advisory GHSA-84xr-327r-c8vf and cataloged under MAL-2026-11408. Due to the nature of the compromise, simply removing the package may not eliminate all malicious components introduced. Secrets and keys stored on the compromised system should be rotated immediately from a secure environment.

Systems with the 'vcse' package installed or running are considered fully compromised, meaning attackers may have complete control over the system. This includes potential unauthorized access to sensitive data, credentials, and system resources. The presence of this package poses a critical security risk to affected environments.

Remove the 'vcse' package versions 1.0.0 and 1.0.1 immediately from all affected systems. Because the system may be fully compromised, assume that additional malicious software could be present beyond the package itself. Rotate all secrets, keys, and credentials stored on the affected machines using a separate, trusted device. Conduct a thorough investigation and remediation to ensure no persistent threats remain.