Malware in @engagehub/core

A malware incident was identified in the npm package @engagehub/core, published via GitHub Advisory GHSA-5hgc-pmxv-3xh7 on July 7, 2026.\n\nAny computer with this package installed or running should be considered fully compromised. The malware grants full control of the affected system to an outside entity.\n\nImmediate remediation is required: all secrets and keys stored on affected computers must be rotated from a different, uncompromised system. The package should be removed, though complete removal of all malicious software cannot be guaranteed due to the level of system compromise.\n\nThis represents a critical supply chain attack through package distribution.