Malicious code in @wanzlonelyy/bailslonely (npm)

The npm package @wanzlonelyy/bailslonely is identified as malicious software. Installation or execution of this package results in a full system compromise, potentially granting an attacker complete control over the affected computer. This includes the risk of theft or misuse of any secrets or keys stored on the system. Removal of the package alone may not fully eradicate the malicious presence, as the attacker might have installed additional backdoors or malware. Therefore, all secrets and keys must be rotated from a separate, uncompromised device to mitigate ongoing risk.

Full compromise of any computer with the package installed or running. All secrets and keys stored on the compromised system are at risk and should be considered exposed. The attacker may maintain persistent access beyond removal of the package.

Remove the @wanzlonelyy/bailslonely package immediately from all affected systems. Rotate all secrets and keys from a different, trusted computer to prevent unauthorized access. Due to the potential for persistent compromise, further forensic analysis and remediation may be necessary to ensure complete removal of malicious software.