Malicious code in @yane88/listary (npm)

The npm package @yane88/listary versions 1.0.0 and 1.0.1 have been identified as containing malicious code or consuming dependencies with malicious code. According to sources including amazon-inspector and ghsa-malware, any system with this package installed should be considered fully compromised. The malicious code may grant attackers full control over the system, necessitating immediate rotation of all secrets and keys from a separate, uncompromised device. Simply uninstalling the package does not guarantee removal of all malicious artifacts.

Systems with @yane88/listary versions 1.0.0 or 1.0.1 installed are at high risk of full compromise. Attackers may gain complete control over the affected computer, potentially accessing or exfiltrating sensitive information such as secrets and keys. This compromises the confidentiality and integrity of the system and any data stored on it.

Remove the @yane88/listary package immediately from all affected systems. Rotate all secrets and keys from a separate, trusted device to prevent unauthorized access. Because the system may be fully compromised, consider rebuilding or thoroughly cleaning the affected machines to ensure complete removal of malicious code. Monitor for any suspicious activity related to this package.