Malicious code in @viertechjs/api (npm)

The @viertechjs/api package version 1.0.0 was identified as containing malicious code or consuming a dependency with malicious code. According to sources including Amazon Inspector and GHSA malware advisories, any system with this package installed should be considered fully compromised. The malicious code may allow an attacker full control over the system, necessitating immediate secret and key rotation from a separate secure environment. Removal of the package does not guarantee complete remediation due to potential persistence of malicious software.

Systems with @viertechjs/api version 1.0.0 installed are fully compromised, potentially allowing attackers complete control. All stored secrets and keys on the affected system are at risk and must be rotated. Simply uninstalling the package may not remove all malicious artifacts, implying a high risk of persistent compromise.

Remove the @viertechjs/api package version 1.0.0 immediately. Rotate all secrets and keys from a different, secure computer. Due to the likelihood of persistent compromise, consider rebuilding or thoroughly cleaning affected systems. No official patch or fix is available; remediation relies on removal and secret rotation.