Malware in @finantix/webcomponents

A malware incident was identified in the npm package @finantix/webcomponents, published as GitHub Advisory GHSA-hf7q-222g-654m on June 29, 2026.\n\nAny computer with this package installed or running should be considered fully compromised. The malware grants outside entities full control of affected systems, allowing potential exfiltration of secrets, keys, and other sensitive data.\n\nImmediate remediation requires rotating all secrets and keys from a different, uncompromised computer. While the package should be removed, complete removal of all malicious software cannot be guaranteed due to the level of system compromise achieved by the malware.\n\nUsers should assume that any credentials, API keys, or sensitive information stored on affected systems have been exposed and take appropriate action to revoke and rotate them.