Malicious code in @yane88/listary-01 (npm)

The npm package @yane88/listary-01 versions 1.0.0 and 1.0.1 have been identified as containing malicious code or relying on dependencies with malicious code. According to the source advisories, any system with this package installed or running should be considered fully compromised. The malicious code can potentially give an attacker full control over the affected system, necessitating immediate secret and key rotation from a separate secure environment. Removal of the package does not guarantee complete remediation due to possible persistent backdoors or additional malware installed.

Systems with @yane88/listary-01 versions 1.0.0 or 1.0.1 installed are at risk of full compromise. Attackers may gain complete control over the system, potentially accessing all stored secrets and keys. This can lead to unauthorized data access, credential theft, and further system exploitation. The compromise is severe enough that simply uninstalling the package may not remove all malicious artifacts.

Immediately remove the @yane88/listary-01 package versions 1.0.0 and 1.0.1 from affected systems. Rotate all secrets, keys, and credentials stored on the compromised system from a different, secure machine. Conduct a thorough investigation and remediation to identify and remove any persistent malicious software or backdoors. Because removal of the package alone may not fully restore system integrity, consider rebuilding the affected systems if possible.