Malware in @live-backstage-im/communication-chat

A malicious package @live-backstage-im/communication-chat was identified in the npm ecosystem and published as a GitHub Security Advisory (GHSA-h887-mrmh-2fjr) on June 29, 2026.\n\nAny computer with this package installed or running should be considered fully compromised. The malware grants outside entities full control of affected systems, potentially allowing installation of additional malicious software beyond the package itself.\n\nImmediate action is required: all secrets and keys stored on affected computers must be rotated from a different, uncompromised system. While the package should be removed, removal alone may not eliminate all malicious software that resulted from the initial installation.