The npm package @telekom-wfa/auth-core versions 99.9.11 and 99.9.12 contain malicious code. This malware includes hardcoded Telegram credentials, data exfiltration capabilities, and executes a preinstall script, indicating intentional malicious behavior. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems must be rotated from a separate, secure device. Removal of the package alone may not eliminate all malicious components due to potential full system compromise.