Malware in @kl-dolphin/swim

A malware incident was identified in the npm package @kl-dolphin/swim, published as GitHub Advisory GHSA-rr7c-77w4-j8c8 on June 24, 2026.\n\nAccording to the advisory, any computer with this package installed or running should be considered fully compromised. The malware grants outside entities full control of affected systems.\n\nImmediate remediation steps include removing the package and rotating all secrets and keys from a different, unaffected computer. However, the advisory notes that removal of the package may not eliminate all malicious software that resulted from the installation, given the level of system compromise.\n\nUsers should assume complete loss of confidentiality and integrity on any system where this package was present.