Malicious code in @veertly/web-app (npm)

The @veertly/web-app npm package in versions 99.9.9, 100.0.0, and 100.0.2 has been identified as containing malicious code. Installation or execution of this package can lead to a complete compromise of the affected system. The malicious code may allow an attacker to gain full control over the computer, putting all stored secrets and keys at risk. Due to the severity of the compromise, simply uninstalling the package may not be sufficient to remove all malicious artifacts.

Systems with the affected versions of @veertly/web-app installed or running are considered fully compromised. Attackers may have gained full control over the system, risking exposure or theft of all stored secrets and keys. This represents a critical security risk requiring immediate action.

Remove the affected @veertly/web-app package versions from all systems. Immediately rotate all secrets and keys from a separate, uncompromised machine. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the affected machines to ensure removal of all malicious software.