Malicious code in @yane88/idea-2026.2-06 (npm)

The npm package @yane88/idea-2026.2-06 version 1.0.0 has been identified as containing malicious code or relying on a malicious dependency. According to sources including Amazon Inspector and GHSA malware advisories, any system with this package installed should be considered fully compromised. The malicious code may grant attackers full control over the system, necessitating immediate rotation of all secrets and keys from a separate, uncompromised device. Simply uninstalling the package may not remove all malicious artifacts or backdoors introduced by the package.

Systems with @yane88/idea-2026.2-06 version 1.0.0 installed are at risk of full compromise. Attackers may gain complete control over the affected computer, leading to potential theft or misuse of credentials, secrets, and sensitive data. The compromise may persist even after removal of the package, increasing the risk of ongoing unauthorized access.

Remove the @yane88/idea-2026.2-06 package version 1.0.0 immediately from all affected systems. Rotate all secrets, keys, and credentials from a separate, secure computer to prevent further unauthorized access. Because full system compromise is possible, consider conducting a thorough incident response and system rebuild to ensure complete remediation. No official patch or fix is available; the package should be avoided entirely.