Malware in pfp-forms-mobile-sme-group-tiles

A malware incident has been identified in the npm package pfp-forms-mobile-sme-group-tiles, published via GitHub Advisory GHSA-9vp2-g2wh-59wm on August 5, 2026.\n\nAny computer with this package installed or running should be considered fully compromised. The malware grants outside entities full control of affected systems, potentially allowing exfiltration of secrets, keys, and other sensitive data.\n\nImmediate remediation requires rotating all secrets and keys from a separate, uncompromised computer. While the package should be removed, complete removal of all malicious software cannot be guaranteed due to the level of system compromise.\n\nAffected users should treat their systems as potentially fully compromised and take appropriate incident response measures.