Malicious code in @viertechjs/wb (npm)

The npm package @viertechjs/wb in specific versions (6.0.0-vier.3, 6.0.0-vier.4, 6.0.0-vier.5, 6.0.0-vier.6, 6.0.0-vier.7, 6.0.0-vier.8) was found to contain malicious code or to consume dependencies that include malicious code. According to sources including Amazon Inspector and GHSA malware advisories, any system with this package installed should be considered fully compromised. The malicious code presence implies that attackers may have gained control over the system, necessitating immediate secret and key rotation from a different, uncompromised machine. The package removal is recommended but may not guarantee full remediation due to possible persistent compromise.

Systems with the affected versions of @viertechjs/wb installed are considered fully compromised. Attackers may have gained complete control, risking exposure of all stored secrets and keys. The compromise could allow unauthorized access, data theft, or further malicious activity. Because the malicious code may persist beyond package removal, the threat is severe and remediation requires comprehensive incident response.

Remove the affected @viertechjs/wb package versions immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure machine. Conduct a thorough investigation and remediation of the affected system to identify and remove any persistent malicious components. There is no official patch or fix available; thus, the best mitigation is to avoid using these package versions and to treat affected systems as compromised.