The jsx-a11y npm package version 5.9.0 contains malicious code that installs a dependency from a custom domain which runs an information stealer during installation. This malware targets npm, git, and CI/CD tokens, potentially compromising all secrets and keys on the infected computer. Removal of the package does not guarantee complete eradication of the malicious software, and immediate rotation of all secrets from a different machine is strongly advised.