The web-api-node package in versions 1.3.2 to 1.3.3 is identified as containing malicious code. Installation or execution of this package results in a full compromise of the host system, potentially allowing an attacker to gain complete control. Due to the severity of the compromise, all credentials and secrets on the affected system should be considered exposed and rotated immediately from a trusted environment. Removal of the package does not ensure complete remediation because the attacker may have deployed additional malicious software or backdoors.

Systems with the affected versions of web-api-node installed are fully compromised, risking exposure of all stored secrets and keys. The attacker may have persistent control beyond the presence of the malicious package itself, leading to a severe security breach.

Remove the web-api-node package versions 1.3.2 through 1.3.3 from affected systems. Immediately rotate all secrets and keys stored on the compromised system from a separate, secure machine. Conduct a thorough investigation and remediation to identify and remove any additional malicious software or backdoors that may have been installed. Because full control may have been given to an attacker, consider rebuilding the affected systems from known good backups.