Malicious code in @yane88/workbuddy-02 (npm)

The npm package @yane88/workbuddy-02 in versions 1.0.0, 1.0.1, 1.0.2, and 1.0.3 was found to contain malicious code or a dependency with malicious code, as reported by Amazon Inspector and the GitHub Security Advisory database. This malicious code can fully compromise any computer where the package is installed or running, potentially exposing all stored secrets and keys. The advisory strongly recommends immediate rotation of all credentials from a different, uncompromised system. Removal of the package alone does not guarantee eradication of the malware due to possible persistence mechanisms.

Systems with this package installed or running should be considered fully compromised. The attacker may have gained full control over the system, risking exposure of all stored secrets and keys. This level of compromise necessitates immediate credential rotation and thorough system remediation beyond just uninstalling the package.

Remove the @yane88/workbuddy-02 package immediately. Rotate all secrets and keys stored on the compromised system from a separate, secure computer. Because full control may have been given to an attacker, additional forensic analysis and system remediation are recommended to ensure complete removal of malicious software. No official patch or fix is available; the package itself is malicious.