The dsh-volcengine-provider npm package versions 0.2.5 and 0.2.8 contain malicious code. Any system with this package installed or running should be considered fully compromised, with potential unauthorized access to secrets and keys. Immediate removal of the package and rotation of all secrets from a separate, uncompromised system is strongly advised.