The npm package @cherrydotfun/miniapp-sdk versions 0.1.22 and 0.1.23 contain malicious code. Any computer with this package installed or running is considered fully compromised, potentially allowing an attacker full control. Immediate removal of the package and rotation of all secrets and keys from a different computer are strongly advised.