Malicious code in zip-bundle (npm)

The 'zip-bundle' npm package version 7.3.1 has been identified as containing malicious code. Installation or execution of this package results in a full system compromise, granting an attacker complete control over the affected computer. The malicious code may persist beyond removal of the package, indicating potential additional malware or backdoors installed. This threat requires urgent attention to prevent further damage and data exposure.

Full compromise of any computer with the affected package installed or running. All secrets and keys stored on the compromised system are at risk and should be considered exposed. Removal of the package alone may not fully remediate the infection due to possible persistence mechanisms.

Remove the 'zip-bundle' package version 7.3.1 immediately from all affected systems. Rotate all secrets and keys from a different, uncompromised computer to prevent unauthorized access. Conduct a thorough system investigation and remediation to identify and remove any additional malicious software that may have been installed. There is no official patch or fix; remediation relies on removal and secret rotation.